NAVAL 

POSTGRADUATE 

SCHOOL 

MONTEREY,  CALIFORNIA 


THESIS 


ENERGY  CHANGE  DETECTION  TO  ASSIST  IN 
TACTICAL  INTELLIGENCE  PRODUCTION 

by 

Derek  A.  Filipe 
June  2009 

Thesis  Co-Advisors:  Karl  D.  Pfeiffer 

Daniel  W.  Bursch 


Approved  for  public  release;  distribution  is  unlimited 


THIS  PAGE  INTENTIONALLY  LEFT  BLANK 


REPORT  DOCUMENTATION  PAGE 


FormApprovedOMBNo^0704-018^^ 
Public  reporting  burden  for  this  collection  of  information  is  estimated  to  average  1  hour  per  response,  including  the  time  for  reviewing  instruction, 
searching  existing  data  sources,  gathering  and  maintaining  the  data  needed,  and  completing  and  reviewing  the  collection  of  information.  Send 
comments  regarding  this  burden  estimate  or  any  other  aspect  of  this  collection  of  information,  including  suggestions  for  reducing  this  burden,  to 
Washington  headquarters  Services,  Directorate  for  Information  Operations  and  Reports,  1215  Jefferson  Davis  Highway,  Suite  1204,  Arlington,  VA 
22202-4302,  and  to  the  Office  of  Management  and  Budget,  Paperwork  Reduction  Project  (0704-0188)  Washington  DC  20503. 

I.  AGENCY  USE  ONLY  (Leave  blank)  2.  REPORT  DATE  3.  REPORT  TYPE  AND  DATES  COVERED 

June  2009  Master’s  Thesis 

4.  TITLE  AND  SUBTITLE  Energy  Change  Detection  to  Assist  in  Tactical  5.  FUNDING  NUMBERS 

Intelligence  Production _ 

6.  AUTHOR(S)  Derek  Anthony  Filipe 

7.  PERFORMING  ORGANIZATION  NAME(S)  AND  ADDRESS(ES)  8.  PERFORMING  ORGANIZATION 

Naval  Postgraduate  School  REPORT  NUMBER 

Monterey,  CA  93943-5000 

9.  SPONSORING  /MONITORING  AGENCY  NAME(S)  AND  ADDRESS(ES)  10.  SPONSORING/MONITORING 
N/A  AGENCY  REPORT  NUMBER 

II.  SUPPLEMENTARY  NOTES  The  views  expressed  in  this  thesis  are  those  of  the  author  and  do  not  reflect  the  official  policy 

or  position  of  the  Department  of  Defense  or  the  U.S.  Government. _ 

12a.  DISTRIBUTION  /  AVAILABILITY  STATEMENT  12b.  DISTRIBUTION  CODE 

Approved  for  public  release;  distribution  is  unlimited _ 

13.  ABSTRACT  (maximum  200  words) 

Currently,  signals  intelligence  (SIGINT)  analysts  are  constantly  overwhelmed  by  the  amount  of  data  they 
ingest.  A  relatively  new  technology,  known  as  Energy  Change  Detection  (ECD),  was  fashioned  in  order  to  alleviate  a 
portion  of  the  “background  noise,”  or  signals  of  non-interest  to  the  SIGINT  analyst.  ECD  has  been  tested  and  its 
operational  capability  verified  and  validated  by  senior  analysts.  With  the  current  organizational  structure  within 
which  ECD  resides,  its  utility  to  the  tactical  user  is  limited.  This  limitation  affects  both  the  timeliness  of  intelligence 
production  and  volume  of  users  it  can  accommodate.  An  analytical  model  was  devised  to  determine  the  sources  of 
latency  in  response  to  a  request  for  information  (RFI).  Various  obstacles  are  highlighted  and  a  revised  operating 
procedure  was  modeled.  This  thesis  analyzes  four  aspects  of  an  organization  (task,  technology,  structure,  and  actors) 
and  proposes  a  change  in  ECD  implementation  to  affect  the  production  of  tactical  intelligence.  The  intent  of  the 
revision,  along  with  providing  ECD  to  a  tactical  intelligence  cell,  is  to  allow  the  tactical  commander  to  make  more 
effective  decisions  with  respect  to  the  employment  and  deployment  of  forces,  types  of  forces  (kinetic  versus  non- 
kinetic)  to  employ,  and  maximizing  the  efficiency  of  organic  intelligence  collection  assets.  The  organizational 
revision,  coupled  with  required  analyst  training,  allows  information  to  be  pushed  to  a  tactical  intelligence  cell  and 
commander  within  a  window  of  six  hours  from  collection  of  the  signal.  This  window  allows  for  the  production  of 
actionable  intelligence,  increases  the  efficiency  of  SIGINT  analysts,  and  potentially  drives  tactical  operations. 

14.  SUBJECT  TERMS  Tactical  Intelligence,  Leavitt’s  Diamond,  OODA  Loop,  Kendall’s  Notation,  15.  NUMBER  OF 
Global  War  on  Terror  (GWOT),  Energy  Change  Detection,  Information  Theory,  Information  Entropy  PAGES 

97 

16.  PRICE  CODE 


17.  SECURITY 

18.  SECURITY 

19.  SECURITY 

20.  LIMITATION  OF 

CLASSIFICATION  OF 

CLASSIFICATION  OF  THIS 

CLASSIFICATION  OF 

ABSTRACT 

REPORT 

PAGE 

ABSTRACT 

Unclassified 

Unclassified 

Unclassified 

UU 

NSN  7540-01-280-5500  Standard  Form  298  (Rev.  2-89) 

Prescribed  by  ANSI  Std.  239-18 


1 


THIS  PAGE  INTENTIONALLY  LEFT  BLANK 


11 


Approved  for  public  release;  distribution  is  unlimited 

ENERGY  CHANGE  DETECTION  TO  ASSIST  IN 
TACTICAL  INTELLIGENCE  PRODUCTION 


Derek  Anthony  Filipe 
Captain,  United  States  Marine  Corps 
B.S.,  The  George  Washington  University,  2003 


Submitted  in  partial  fulfillment  of  the 
requirements  for  the  degrees  of 

MASTER  OF  SCIENCE  IN  SYSTEMS  TECHNOLOGY  (COMMAND, 
CONTROL,  AND  COMMUNICATIONS) 

and 

MASTER  OF  SCIENCE  IN  SPACE  SYSTEMS  OPERATIONS 


from  the 


NAVAL  POSTGRADUATE  SCHOOL 
June  2009 


Author:  Derek  Anthony  Filipe 


Approved  by:  Karl  D.  Pfeiffer 

C4I  Thesis  Advisor 


Dan  W.  Bursch 
SSO  Thesis  Advisor 


Dan  C.  Boger 

Chairman,  Department  of  Information  Sciences 


Rudolf  Panholzer 

Chairman,  Space  Systems  Academic  Group 
iii 


THIS  PAGE  INTENTIONALLY  LEFT  BLANK 


IV 


ABSTRACT 


Currently,  signals  intelligence  (SIGINT)  analysts  are  constantly  overwhelmed  by 
the  amount  of  data  they  ingest.  A  relatively  new  technology,  known  as  Energy  Change 
Detection  (ECD),  was  fashioned  in  order  to  alleviate  a  portion  of  the  “background  noise,” 
or  signals  not  of  interest  to  the  SIGINT  analyst.  ECD  has  been  tested  and  its  operational 
capability  verified  and  validated  by  senior  analysts.  With  the  current  organizational 
structure  within  which  ECD  resides,  its  utility  to  the  tactical  user  is  limited.  This 
limitation  affects  both  the  timeliness  of  intelligence  production  and  volume  of  users  it  can 
accommodate.  An  analytical  model  was  devised  to  determine  the  sources  of  latency  in 
response  to  a  request  for  information  (RFI).  Various  obstacles  are  highlighted  and  a 
revised  operating  procedure  was  modeled.  This  thesis  analyzes  four  aspects  of  an 
organization  (task,  technology,  structure,  and  actors)  and  proposes  a  change  in  ECD 
implementation  to  affect  the  production  of  tactical  intelligence.  The  intent  of  the 
revision,  along  with  providing  ECD  to  a  tactical  intelligence  cell,  is  to  allow  the  tactical 
commander  to  make  more  effective  decisions  with  respect  to  the  employment  and 
deployment  of  forces,  types  of  forces  (kinetic  versus  non-kinetic)  to  employ,  and 
maximizing  the  efficiency  of  organic  intelligence  collection  assets.  The  organizational 
revision,  coupled  with  required  analyst  training,  allows  information  to  be  pushed  to  a 
tactical  intelligence  cell  and  commander  within  a  window  of  six  hours  from  collection  of 
the  signal.  This  window  allows  for  the  production  of  actionable  intelligence,  increases 
the  efficiency  of  SIGINT  analysts,  and  potentially  drives  tactical  operations. 
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I. 


INTRODUCTION 


A.  MOTIVATION 

The  man  who  will  go  where  his  colors  go,  without  asking,  who  will  fight  a 
phantom  foe  in  the  jungle  and  mountain  range,  without  counting,  and  who 
will  suffer  and  die  in  the  midst  of  incredible  hardship,  without  complaint, 
is  still  what  he  has  always  been,  from  Imperial  Rome  to  sceptered  Britain 
to  democratic  America.  He  is  the  stuff  of  which  legions  are  made. ..His 
pride  is  in  his  colors  and  his  regiment,  his  training  hard  and  thorough  and 
coldly  realistic,  to  fit  him  for  what  he  must  face...  and  his  obedience  is  to 
his  orders.  He  has  been  called  United  States  Marine. 

-  T.  R.  Fehrenback,  This  Kind  of  War 

Almost  seven  and  a  half  years  into  the  Global  War  on  Terror  (GWOT),  an 
increasingly  heavy  burden  has  been  placed  on  the  intelligence  community  (IC)  to  provide 
timely  and  actionable  intelligence  to  the  tactical  user.  Still,  in  2009,  too  many  times  on 
the  battlefields  of  Iraq  and  Afghanistan  have  there  been  U.S.  or  Coalition  casualties, 
which  could  have  been  avoided  if  the  correct  intelligence  was  “pushed  down”  to  the 
appropriate  tactical  commander.  There  have  been  too  many  instances  of  useful 
intelligence  reaching  a  tactical  unit  24  or  72  hours  late. 

The  motivation  behind  this  thesis  is  to  provide  more  timely  and  actionable 
intelligence  to  tactical  units  worldwide  by  altering  the  organization  of  technology, 
personnel,  and  specific  databases.  The  particular  data  in  question  will  be  processed 
through  a  relatively  new  technology  (referred  to  throughout  the  thesis  as  “the  process”  or 
Energy  Change  Detection)  focused  on  energy  signatures  of  multiple  types.  This 
processed  information  will  allow  tactical  users  to  focus  and  integrate  organic  intelligence 
collection  assets,  Civil  Affairs  Groups  (CAGs),  human  intelligence  (HUMINT) 
personnel,  Psychological  Operations  Groups  (PSYOPS),  reconnaissance  units,  and/or 
other  operational  units  in  order  to  successfully  complete  the  commander’s  mission. 
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B.  THESIS  OBJECTIVE 


The  overall  goal  of  this  thesis  is  the  optimization  of  a  classic  sensor-to-shooter 
information  flow  model.  The  main  objectives  are  outlined  below: 

•  Analyze  and  model  the  current  process  of  energy  change  detection  (ECD) 
once  a  request  for  information  (RFI)  is  sent  to  the  queue. 

•  Determine  areas  within  the  current  process  where  optimization  is  possible 
and  mandatory  in  order  to  provide  tactical  intelligence. 

•  Develop  a  model  of  a  proposed  process  capable  of  providing  intelligence 
to  conduct  tactical  operations  in  a  timely  manner. 

•  Suggest  an  operating  tactical  unit  who  would  greatly  benefit  from  having 
ECD  as  one  of  its  capabilities. 

•  Demonstrate  scenarios  where  ECD  would  be  useful. 

C.  OVERVIEW  OF  EXPERIMENTAL  PLAN 

ECD  will  allow  SIGINT  analysts  and  military  commanders  alike  to  focus  their 
assets  on  the  mission  to  maximize  effectiveness.  According  to  the  Code  of  Best  Practices 
for  Experimentation  (COBP),  discovery  experiments  “...  may  involve  pure  models  and 
computer  simulations  to  place  the  new  concept  in  the  context  of  other  factors,  or  human- 
in-the-loop  experiments  to  learn  how  people  relate  to  the  innovation  and  choose  to 
employ  it”  (Alberts  and  Hayes,  2002).  ECD  has  passed  all  initial  experimentation, 
verification,  and  validation1  and  is  being  utilized  operationally  on  a  small  scale. 

The  COBP  states: 

Even  when  an  initial  discovery  experiment  is  successful  in  suggesting 
military  utility  and  some  way  of  employing  the  innovation,  more  research 
and  discovery  experimentation  will  usually  be  required  to  validate  the 
initial  finding,  to  refine  the  employment  concepts,  or  to  determine  the 
conditions  under  which  the  innovation  is  most  likely  to  provide  significant 
payoff.  (Alberts  and  Hayes,  2002) 


1  Details  of  all  experimentation,  verification,  and  validation  are  classified. 
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A  mature  operating  procedure  does  not  exist  for  this  technology  yet.  Ideally,  as  a 
technology  is  being  developed,  a  standard  operating  procedure  is  being  developed 
concurrently.  More  commonly,  a  new  technology  is  developed,  proven  useful,  and  then  a 
decision  on  the  correct  implementation  is  discussed.  This  is  the  case  with  many  new 
technologies;  a  way  to  employ  a  technology  effectively  has  not  been  established,  nor  are 
the  possible  implications  understood  at  the  strategic,  operational,  or  tactical  levels  of 
warfare.  A  mature  operating  procedure  developed  now  while  operational  use  is  minimal, 
will  maximize  the  effects  on  the  decision-maker. 

The  hypothesis:  If  Energy  Change  Detection  is  provided  to  a  tactical  intelligence 
cell  then  the  potential  for  more  effective  decision-making  by  the  tactical  commander 
exists,  focusing  the  SIGINT  analyst  on  signals  of  tactical  interest  and  maximizing  the 
effectiveness  of  organic  intelligence  collection  assets.  Figure  1  illustrates  this  hypothesis. 


Figure  1.  Illustration  of  Hypothesis. 


Modeling  and  quantitative  analysis  will  be  used  to  test  this  hypothesis  and  show 

the  utility  of  this  technology  at  the  tactical  level.  The  current  process  will  be  analyzed. 

This  analysis  will  then  be  validated  by  historical  data  (using  all  RFIs  fulfilled  in  2008) 

and  verified  by  the  analysts  whom  are  current  fulfilling  all  RFIs.  A  proposed  solution 

will  be  modeled.  A  comparison  of  both  models  with  respect  to  the  time  required  to  fulfill 

an  RFI  and  the  volume  of  RFIs  handled  per  unit  time  will  be  made.  Results  of  this 

comparison  will  either  prove  or  disprove  the  hypothesis. 

Following  this  analysis,  ECD  will  be  fielded  to  a  tactical  military  unit  to  be  tested 

in  real-world  operations.  Upon  completion  of  that  unit’s  operational  deployment, 

collaboration  between  intelligence  analysts,  commanders,  and  research  personnel  will 
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occur.  After  action  reports  and  lessons  learned  will  be  part  of  the  operating  procedure 
revision  process.  Once  these  revisions  transpire,  this  technology  will  be  acquired  and 
fielded  to  all  relative  operating  forces  and  on  the  proper  information  dissemination 
system  or  systems. 

D.  THESIS  ORGANIZATION 

The  rest  of  this  thesis  is  organized  as  follows.  Chapter  II  provides  background 
information  on  the  new  technology  being  proposed.  Various  sources  of  power  are 
discussed  and  related  to  an  asymmetrical  adversary.  It  explains  the  difference  between 
information  and  intelligence  and  relates  these  to  sources  of  authority  and  clout.  Also, 
Chapter  II  goes  into  detail  on  the  implication  on  the  adversary’s  OODA  loop  and  the 
collection  and  storage  systems  form  where  the  data  is  being  derived  from.  A  summary  of 
Harlod  Leavitt’s  theory,  known  as  the  Leavitt  Diamond,  is  submitted  along  with  an 
explanation  on  the  employment  of  his  theory  to  ECD.  This  research  will  analyze  and 
model  various  portions  of  the  current  process  once  an  RFI  is  submitted  via  a  tactical  user. 

Chapter  III  describes  the  author’s  proposed  solution  to  the  latency  of  the  current 
process.  This  proposed  solution  includes  the  organization  of  personnel  and  database 
management.  Chapter  III  also  describes  the  proposed  tactical  unit  and  its  intelligence 
collection  capabilities  and  limitations.  A  comparison  of  the  process  frameworks,  as-is 
(Chapter  II)  and  proposed  (Chapter  III),  will  be  presented  in  Chapter  IV.  Also  in  this 
chapter  is  the  quantitative  analysis  on  the  expected  improvements  to  tactical  operations 
with  the  proposed  solution. 

Chapter  V  concludes  the  thesis  by  summarizing  the  work,  describing  significant 
results  to  include  the  usefulness  of  the  proposed  process,  and  recommends  future  work 
necessary  to  validate  the  proposed  process.  Portions  of  this  thesis  are  classified,  and  as 
such,  not  included  in  the  unclassified  version.  Those  portions  are  stored  in  the 
appropriate  location. 
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II.  BACKGROUND 


A.  INTRODUCTION 

1.  Sources  of  Information 

The  cliche  “information  is  power”  is  as  true  today  as  it  was  at  the  onset  of 
civilization.  The  sharing  of  information  seems  almost  counterintuitive  to  human  nature 
because  of  this  fact,  and  may  very  well  be  the  underlying  reason  why  intelligence  sharing 
amongst  various  organizations  within  the  IC  is  a  topic  of  concern.  However,  sources  of 
information  exist  everywhere;  and  a  lot  of  times  they  exists  where  people  least  expect. 
Many  essays  and  papers,  especially  in  today’s  world  concerned  with  asymmetrical 
warfare2,  have  been  written  (e.g.,  Arquilla  and  Ronfeldt,  1996)  on  the  topic  of 
information  as  a  source  of  power. 

The  fact  that  information  exists  in  non-physical  matter  (and  more  inclusively  -  all 
matter)  is  not  a  new  concept.  According  to  John  Arquilla  and  David  Ronfeldt  (1996), 
“information,  generally  thought  to  be  immaterial,  is  increasingly  seen  to  be  an  essential 
part  of  all  matter.”  While  “power,  long  thought  to  be  based  mainly  on  material  resources, 
is  increasingly  seen  to  be  fundamentally  immaterial,  even  metaphysical  in  nature.” 
Arquilla  and  Ronfeldt  view  information  in  three  views.  Two  views: 

...  are  widespread.  The  first  considers  information  in  terms  of  the 
inherent  message,  the  second  in  terms  of  the  medium  of  production, 
storage,  transmission,  and  reception.  The  emerging  third  view  transcends 
the  former  two;  it  speculates  that  information  may  be  a  physical  property  - 
as  physical  as  mass  and  energy,  and  inherent  in  all  matter.  (1996) 

This  third  view  is  the  focus  of  ECD.  Considering  information  a  physical  element  and 
present  in  all  matter  is  a  powerful  concept.  More  powerful  is  the  concept  of  information 
residing  in  all  energy. 

Information  is  present  throughout  the  entire  electromagnetic  (EM)  spectrum. 
Figure  1  is  a  typical  illustration  of  the  EM  spectrum  with  some  of  common  bands  labeled. 

2  In  order  to  scope  this  thesis,  the  term  “asymmetrical  adversary”  is  used  interchangeably  with 
“insurgent”  or  “insurgency.” 
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Figure  2.  The  Electromagnetic  Spectrum  (From  Keiner,  2009). 

As  humans,  we  typically  understand  that  information  is  contained  within  the  visible  and 
radio  frequency  portions  of  the  spectrum.  This  is  to  say  that  what  we  hear  and  see  supply 
our  neurological  sensors  with  signals  that,  when  properly  received,  provide  a  human 
being  information.  We  even  understand  the  lack  of  energy  in  this  spectrum  range,  i.e,.  an 
image  of  a  naval  port  without  naval  assets  located  there  gives  intelligence  analysts  a 
certain  amount  of  information.  A  radio  channel  that  is  not  transmitting  as  normal  also 
provides  a  certain  level  of  information.  Information  does  not  need  to  be  contained  within 
the  energy  (or  waveform).  The  mere  existence  or  absence  of  energy  can  provide  an 
abundance  of  information.  And  with  this  information,  useful  intelligence  may  be 
derived. 
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2. 


Information  as  a  Source  of  Power 


Power  is  the  great  aphrodisiac. 

-  Henry  Kissinger  (New  York  Times,  1971) 

If  such  a  heavy  emphasis  is  placed  on  identifying  sources  of  information,  then  one 
can  assume  that  information  is  a  source  of  power.  Otherwise,  no  one  would  care  who  had 
access  to  certain  compartmented  information.  There  are  numerous  definitions  given  to 
the  term  “power.”  Not  only  are  there  many  definitions,  but  there  are  many  disciplines, 
which  can  be  referenced  with  “power.”  And  within  each  discipline  there  are  many 
distinct  sources  of  “power.” 

Like  most  other  entities,  power  can  be  defined  in  terms  of  quantitative  and 
qualitative  measurements.  Quantitatively,  power  is  the  amount  of  work  (or  energy)  done 
per  unit  time  (Serway,  1996).  Solar,  electrical,  and  mechanical  power  are  examples  of 
power  that  can  be  classified  as  quantitative. 

A  qualitative  assessment  of  power  becomes  more  difficult.  The  DIME  theory 
(Diplomatic,  Information,  Military,  and  Economic)  is  a  well-known  theory  to  categorize 
the  source  of  power  of  state  actors.  Military  and  economic  sources  of  power  can  be 
quantified  easily  (i.e.,  order-of-battle  and  gross  domestic  product  analysis).  Diplomacy 
and  amount  of  useful  information  are  characteristics  much  more  difficult  to  quantify. 

How  does  the  United  States  match  up  versus  a  non-state  actor  in  these  categories? 
The  answer  is  relatively  simple  to  produce.  Diplomacy  is  not  applicable  when  dealing 
with  non-state  actors.  Both  militarily  and  economically,  the  U.S.  dominates  non-state 
actors.  Then  how  come  asymmetrical  warfare  is  so  costly  for  Americans?  The  answer 
lies  in  the  informational  realm.  Table  1  below  compares  many  factors  of  symmetrical 
and  asymmetrical  warfare.  The  “Key  question”  factor,  under  Information,  is  important  in 
understanding  information  as  a  source  of  power.  “  What  information  to  get”  is  the  focus 
vice  “Eow  to  get  information”  (NATO,  2002).  As  stated  earlier,  the  U.S.  does  not  have  a 
capability  gap  in  the  “How.  ’’  The  gap  resides  in  the  “What.  ” 
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Factor 

Symmetrical,  Conventional 

Operations  other  than  War 

Mission/Operation 

Stability 

Relatively  stable 

May  be  more  dynamic 

Focus 

Enemy 

No  traditional  opponent 

Commitment 

Common  (military) 

Uncertain  (political/military) 

Principles 

Unity 

Of  command 

Of  purpose 

Decisionmaking 

Hierarchical 

Consensus 

Operations 

Surprise,  secrecy 

Transparency 

Information 

Nature  of  the  Problem 

Known  unknowns 

Unknown  unknowns 

Key  question 

How  to  get  information 

What  information  to  get 

Focus 

Enemy  military 

Military/political/economical/social  factors 

Situational  Awareness 

Common  air-land-sea 

Limited  dissemination,  more  complex 

Databases 

Very  large,  well  structured 

Larger,  less  structured 

Analysis 

Unit 

Battalion  level  entity 

More  behavioural 

Ease  in  integration 

Relatively  easy 

Very  difficult 

Focus 

Military  (systems,  organisations) 

Political/military  and  societal 

Approach 

Traditional  operation  analysis 

"Softer"  analysis 

Table  1.  Factors  of  Symmetrical  and  Asymmetrical  Warfare  (From  NATO,  2002). 

It  has  been  said  by  many  military  strategists,  with  respect  to  the  GWOT,  that  “he  who 
controls  the  people,  controls  the  war.”  This  statement  is  true  in  all  the  current  conflicts 
the  U.S.  military  is  involved.  The  populace  is  controlled  by  information  via  many 
different  mediums  (i.e.,  television,  telephone,  newspaper,  and  the  internet). 

3.  Information  versus  Intelligence 

Don't  be  buffaloed  by  experts  and  elites.  Experts  often  possess  more  data 
than  judgment.  Elites  can  become  so  inbred  that  they  produce 
hemophiliacs  who  bleed  to  death  as  soon  as  they  are  nicked  by  the  real 
world. 


-  General  Colin  Powell,  USA  (CJCS,  1992) 

There  are  many  instances  in  our  everyday  lives  where  the  terms  “information” 
and  “intelligence”  are  used  synonymously.  In  fact,  they  are  two  distinct  concepts  with 
separate  definitions.  Joint  Publication  (JP)  1-02  defines  intelligence  as: 
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1.  The  product  resulting  from  the  collection,  processing,  integration, 
analysis,  evaluation,  and  interpretation  of  available  information 
concerning  foreign  countries  or  areas. 

2.  Information  and  knowledge  about  an  adversary  obtained  through 
observation,  investigation,  analysis,  or  understanding. 

Even  the  Joint  Publication’s  definition  blurs  the  difference  using  the  term  information  to 
define  intelligence.  Figure  3  from  JP  2-01  demonstrates  the  joint  military  view  of  the 
transfer  of  information  and  intelligence  to  the  decision  maker. 


Figure  3.  Analysis  and  Production  Activities  (From  JP  2-01,  III-34). 

An  explanation  of  the  various  levels  of  understanding  is  provided  in  the  information 
pyramid  analysis. 

There  are  many  information  pyramids  in  academia,  and  most  have  three  or  four 
levels.  The  more  complete  versions  differentiate  between  two  types  of  intelligence: 
knowledge  and  wisdom.  Referring  to  Arquilla  and  Ronfeldt’s  In  Athena’s  Camp,  the 
information  described  in  a  pyramid  related  to  the  concept  of  “Information  as  Message” 
where  information  is  expressed  as  “an  immaterial  message  or  signal  that  contains 
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meaningful  (or  at  least  recognizable)  content  and  that  can  be  transmitted  from  a  sender  to 
a  receiver”  (Arquilla  and  Ronfeldt,  1996).  The  information  pyramid  is  visually  portrayed 
in  Figure  4. 


Figure  4.  The  Information  Pyramid  (From  Arquilla  and  Ronfeldt,  1996). 


The  foundation  of  the  pyramid  is  data.  Data  can  come  in  many  forms,  i.e.,  digital 
cable  in  the  form  of  Is  and  Os,  recorded  observation  of  rainfall,  or  facts  listed  in  a 
Farmer’s  Almanac.  The  conversion  of  this  raw  data  to  information  requires  organization. 
Once  the  data  is  arranged  in  such  a  way  that  is  humanly  decodable,  then  the 
transformation  is  complete.  A  typical  example  of  this  is  taking  rows  of  data  in  a 
Microsoft  Excel  spreadsheet  and  creating  a  chart  or  graph  based  on  the  data.  The 
processing  and  exploitation  activities  as  defined  by  JP  2-01  are  captured  in  Figure  5. 


PROCESSING  AND  EXPLOITATION  ACTIVITIES 


Decision  Makers 


Intelligence 

Analysts 


Data  is  Converted  into 
Information  Through 
Processing  and  Exploitation 

•  Signal  Correlation 

•  Imagery  Exploitation 

•  Document  Translation 

•  Formatting 


Figure  5.  Processing  and  Exploitation  Activities  (From  JP  2-01,  III-29). 
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Intelligence  is  analyzed  information.  When  dissecting  intelligence  into 
knowledge  and  wisdom,  then  knowledge  is  the  analyzed  information.  Understanding 
what  the  information  portrays  is  knowledge.  A  very  important  aspect  of  knowledge  is 
that  different  people  will  have  diverse  levels  of  knowledge  based  on  a  certain  set  of 
information.  The  New  York  Stock  Exchange  trend  analysis  is  an  example  of  this.  The 
same  set  of  information  may  cause  one  investor  to  sell  a  stock  and  another  to  buy  that 
same  stock. 

The  distinction  between  the  two  investors  resides  in  their  individual  levels  of 
experience  and  intellect.  Combining  knowledge  with  experience  and  intellect  generates 
the  highest  level  of  understanding;  Wisdom.  Only  knowledge  or  intelligence  products 
may  be  created.  Wisdom  is  used  in  deciphering  and  analyzing  the  intelligence  through 
ones  individual  experiences  and  level  of  intellect.  The  concept  of  levels  of  information 
can  be  confusing  and  frustrating  if  not  understood  correctly.  The  following  scenario  from 
Operation:  IRAQI  FREEDOM  (OIF)  is  used  as  an  example  to  take  the  reader  through  the 
four  stages  of  information. 

a.  Data 

Anytime  an  improved  explosive  device  (IED)  is  found  or  detonated,  a 
detailed  description  of  the  event  is  filed  in  a  database.  Data  is  gathered  and  consolidated 
from  multiple  sources  in  the  database.  Some  properties  of  the  event  are  date,  time, 
location,  unit,  type  of  IED,  type  of  detonation,  type  of  explosives,  found  or  cleared,  and 
casualties.  All  of  this  information  is  stored  in  a  database  and  able  to  be  extracted  via  a 
query  tool.  The  following  table  is  an  example  of  IED  data  taken  from 
http://icasualties.org  and  is  a  list  of  all  IED  fatalities  by  month  since  commencement  of 
OIF  through  February  2009: 
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Apr-08 

29 

May-08 

14 

Jun-08 

11 

Jul-08 

3 

Aug-08 

7 

Sep-08 

3 

Oct-08 

2 

Nov-08 

2 

Dec-08 

1 

Jan-09 

3 

Feb-09 

6 

Total 

1822 

Oct-05 

59 

Nov-05 

41 

Dec-05 

42 

Jan-06 

25 

Feb-06 

38 

Mar-06 

14 

Apr-06 

52 

May-06 

43 

Jun-06 

34 

Jul-06 

23 

Aug-06 

31 

Sep-06 

32 

Oct-06 

54 

Nov-06 

45 

Dec-06 

71 

Jan-07 

36 

Feb-07 

28 

Mar-07 

54 

Apr-07 

72 

May-07 

90 

Jun-07 

74 

Jul-07 

46 

Aug-07 

34 

Sep-07 

28 

Oct-07 

22 

Nov-07 

24 

Dec-07 

8 

Jan-08 

23 

Feb-08 

17 

Mar-08 

21 

Jul-04 

18 

Aug-04 

19 

Sep-04 

16 

Oct-04 

13 

Nov-04 

18 

Dec-04 

14 

Jan-05 

38 

Feb-05 

25 

Mar-05 

13 

Apr-05 

20 

May-05 

35 

Jun-05 

35 

Jul-05 

39 

Aug-05 

40 

Sep-05 

40 

Period 

Fatalities 

Jul-03 

4 

Aug-03 

7 

Sep-03 

6 

Oct-03 

13 

Nov-03 

20 

Dec-03 

18 

Jan-04 

20 

Feb-04 

10 

Mar-04 

20 

Apr-04 

19 

May-04 

26 

Jun-04 

14 

Table  2.  IED  Data  (From  http://icasualties.org). 

It  is  difficult  to  visualize  what  the  table  is  telling  the  reader  because  the  data  is  not 
displayed  in  an  easily  recognizable  format. 

b.  Information 

Displaying  data  in  a  chart  or  graph  is  a  typical  way  to  convert  data  into 
information.  Visualization  allows  a  human  to  take  days-,  weeks-,  months-,  or  years- 
worth  of  data  and  observe  points  of  increase  and  decrease,  levels  of  stability,  and  relative 
number  of  events  compared  to  a  similar  time  period.  From  the  following  table,  an 
individual  can  deduce  that  May  2007  had  the  most  IED  activity  to  date  in  OIF.  There  are 
also  other  local  maxima  (January  2005,  November  2005,  and  December  2007)  and  local 
minima  (April  2006  and  December  2008)  that  require  further  analysis. 
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IED  Fatalities  By  Month 


Table  3.  IED  Graph  (From  http://icasualties.org). 

Sometimes,  improper  deductions  are  made  based  on  a  certain  set  of  information.  From 
the  above  table,  it  would  be  incorrect  to  infer  that  the  drop-off  in  IED  activity  from  May 
2007  to  the  present  is  because  the  Iraqi  Army  has  evolved  into  a  self-sustaining 
organization  able  to  defeat  the  insurgency.  There  are  many  other  factors  that  must  be 
included  in  an  analysis  of  this  magnitude.  Carelessness  in  assumptions  may  lead  to 
incorrect  analysis  of  the  data  and  information. 

c.  Knowledge  (Intelligence) 

Analyzed  information  is  commonly  referred  to  as  intelligence.  As  stated 
above,  intelligence  will  be  broken  into  two  sections;  knowledge  and  wisdom.  Combining 
the  information  provided  above  with  other  sources  of  information  (i.e.,  a  human 
intelligence  report  from  the  same  time  frame)  is  critical  to  converting  the  information  to 
intelligence.  Table  3  above  does  not  give  much  insight  into  the  various  population 
centers  throughout  Iraq.  The  following  six  figures  from  http://icasualties.org  show  the 
IED  events  by  geographic  location  and  year. 

An  example  of  knowledge  gained  from  the  above  information  example  is 
the  heavy  concentration  of  IED  events  in  A1  Anbar  up  through  2006  and  Baghdad  up  to 
2007.  A  decline  in  IED  events  after  2007  suggests  either  another  form  of  attack  is 
becoming  the  primary  insurgent  tactic  or  the  increase  in  number  of  U.S.  Military 
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Servicemen,  known  as  “The  Surge,”  is  helping  to  turn  the  tides.  This  information  may  be 
used  to  deploy  forces  where  IED  events  occur  most  frequently.  One  can  also  see  the 
trend  of  increasing  IED  events  after  2006  to  other  regions  of  the  country.  Providing  the 
analyst  a  better  understanding  of  the  situation  is  possible  by  combining  this  knowledge 
with  other  sources  of  intelligence,  such  as  human  intelligence  or  SIGINT.  Intelligence 
must  be  fused  from  multiple  sources  to  reach  its  full  potential. 
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Figure  6.  IED  Fatalities  in  2003  (From  http://icasualties.org). 
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Figure  7.  IED  Fatalities  in  2004  (From  http://icasualties.org). 
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Figure  8.  IED  Fatalities  in  2005  (From  http://icasualties.org). 


Figure  9.  IED  Fatalities  in  2006  (From  http://icasualties.org). 
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Figure  10.  IED  Fatalities  in  2007  (From  http://icasualties.org). 
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Figure  11.  IED  Fatalities  in  2008  (From  http://icasualties.org). 


Questions  an  analyst  will  ask  him/herself  include  “Why  is  there  a  spike  in 
activity  in  this  year?”  or  “How  were  X  number  of  IEDS  detonated  in  area  A  vice  area  B?” 
Coalition  operations,  religious  holidays  or  events,  or  regional  politics  may  be  the  answer 
or  provide  more  information  to  arrive  at  the  correct  answer.  A  limited  background  in  the 
topic  under  analysis  may  lead  to  an  incorrect  analysis  of  the  information.  This  will 
produce  an  intelligence  report  that  lacks  credibility  and  is  rendered  useless  in  the  eyes  of 
the  IC  and  a  tactical  commander.  A  tactical  commander  may  have  too  much  faith  in  the 
analysis  conducted,  forming  a  situation  where  tactical  operations  are  conducted  on  faulty 
intelligence. 


d.  Wisdom 

Knowledge  will  vary  from  person  to  person,  as  will  wisdom.  Wisdom  is 
an  individual’s  ability  to  apply  analyzed  information  to  personal  experiences  in  the  field 
of  study  along  with  an  in-depth  intellect  in  the  subject  area.  Wisdom  requires  the 
accumulation  of  time  with  respect  to  a  given  subject  area.  An  analyst  in  Washington 
D.C.  with  no  operational  experience  in  Iraq  will  interpret  and  analyze  information  and 
intelligence  differently  than  an  analyst  who  is  currently  on  their  fourth  deployment  in 
support  of  OIF. 
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With  the  above  Iraq  example,  an  in-depth  understanding  of  the  main 
supply  routes,  coalition  activity,  and  local  religious  or  political  agendas  may  persuade  the 
analyst  to  believe  “The  Surge”  was  the  reason  for  recent  success.  Someone  with 
operational  experience  would  attribute  the  recent  success  to  the  Marines  and  soldiers 
embedded  with  Iraqi  Security  Forces.  Their  mission  to  advise,  mentor,  and  train  the  ISF 
laid  the  foundation  for  “The  Surge”  to  be  effective.  This  wisdom  would  not  be  possible 
without  the  operational  experience  necessary  to  understand  the  difference  between  Iraqi 
and  Western  culture. 


e.  Impact  of  ECD  on  the  Information  Pyramid 

ECD  is  a  new  method  of  signals  information  that  displays  relative 
information  and  attempts  to  mask  the  extraneous  activity.  ECD  by  itself  does  not 
produce  intelligence.  This  new  visual  representation  of  emitters  will  permit  SIGINT 
analysts  to  not  only  focus  on  signals  of  interest,  but  also  a  trend  analysis  on  signal 
patterns  in  a  specific  area  of  operations  for  a  given  time  interval.  Focusing  on  signals  of 
interest  allocates  more  of  the  analyst’s  time  to  useful  work,  not  wasting  time  on  signals 
which  are  not  important  to  the  mission.  Conducting  a  trend  analysis  on  the  visualization 
of  signal  patterns  will  provide  the  tactical  commander  an  insight  into  the  selection  and 
utilization  of  forces.  Both  provide  intelligence  to  the  tactical  commander  that  will  aid  in 
mission  success. 

4.  OODA  Loop 

Without  our  genetic  heritage,  cultural  traditions,  and  previous  experiences, 
we  do  not  possess  the  implicit  repertoire  of  psychological  skills  shaped  by 
environments  and  changes  that  have  been  previously  experienced. 

-  Colonel  John  Boyd,  USAF  (The  Essence  of  Winning  &  Losing,  1995) 

Colonel  John  Boyd,  USAF,  developed  the  OODA  (Observe-Orient-Decide-Act) 
loop  originally  to  describe  the  decision  cycle  a  fighter  pilot  constantly  undergoes  in  aerial 
combat.  Because  of  the  speed  at  which  these  engagements  occur,  the  pilot  must  maintain 
fluid,  speedy  cycle.  Colonel  Boyd  showed  many  instances  throughout  history  where  the 
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OODA  loop  framework  could  describe  all  levels  of  warfare.  He  also  “saw  it  deeply 
relevant  to  any  kind  of  competitive  environment:  business,  politics,  sports,  even  the 
struggle  of  organisms  to  survive”  (Greene,  2007).  Figure  12  is  a  simplistic  illustration  of 
Colonel  Boyd’s  conceptual  loop  and  Figure  13  is  a  more  detailed  drawing. 


Figure  12.  The  Simplistic  OODA  Loop  (From  Greene,  2007). 


Figure  13.  A  Detailed  OODA  Loop  (From  Greene,  2007). 


Observations  are  derived  from  all  senses  at  the  commander’s  disposal.  The 
observations  portray  a  visual  image  to  the  commander  of  the  current  situation,  known  as 
“ground  truth,”  allowing  that  commander  to  orient  to  a  given  situation  based  on  past 
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observations.  A  decision  is  formed  and  then  acted  upon.  This  action  (and  decision) 
creates  new  observations  which  then  begin  the  cycle  anew.  Greene  describes  the  main 
elements  as  (Greene,  2007): 

•  Observations  originate  from  human  sources  as  well  as  from  data,  test 
results,  intelligence  sources,  and  models  about  a  situation. 

•  The  goal  of  orientation  is  to  make  sense  of  the  observations. 

•  Making  a  decision  is  not  a  single  action,  but  is  a  process  of  repeatedly 
deciding  what  to  do  next — observe  more  information,  do  further 
orientation,  or  take  action. 

•  The  proof  of  the  success  of  the  OODA  loop  is  in  the  success  of  the  action 
taken. 

An  OODA  loop  is  inherent  in  every  decision-maker.  The  goal  for  a  commander 
is  to  make  their  OODA  loop  run  as  efficiently  and  quickly  as  possible.  In  military 
conflict,  it  is  imperative  to  force  your  adversary  to  react  to  your  operations.  This  is 
accomplished  by  allowing  your  OODA  loop  to  operate  inside  your  adversary’s  OODA 
loop.  Due  to  greater  latencies  in  the  adversary’s  loop  then  the  friendly  loop,  the 
adversary’s  decisions  are  now  based  on  observations  of  friendly  operations. 

Compelling  an  asymmetrical  adversary  to  be  reactive  vice  proactive  is  critical  to 
mission  success.  An  asymmetrical  adversary’s  center  of  gravity  is  the  ability  to  gather 
and  control  information.  This  makes  it  difficult  for  coalition  forces  to  operate  in  various 
geographic  regions  of  conflict.  Interfering  with  an  insurgent’s  ability  to  operate 
effectively  is  directly  related  to  the  capability  of  the  U.S.  military  to  insert  itself  in  the 
adversary’s  OODA  loop.  An  insurgency  will  not  have  the  resources  or  motivation  to 
continuously  react  to  U.S.  military  operations. 

Properly  implemented,  ECD  is  a  tool  that  will  enable  tactical  commanders  to 
conduct  proactive  operations  in  order  to  inhibit  the  insurgency’s  OODA  loop.  ECD  by 
itself  is  inadequate  to  provide  useltil  intelligence.  It  must  be  combined  with  various  other 
assets.  Emplacement  at  a  tactical  intelligence  cell  will  aid  in  focusing  intelligence 
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collection  assets  on  newly  acquired  areas  of  interest  (AOI),  or  reinforce  current 
situational  awareness  of  previously  identified  AOI’s. 

Greene’s  expanded  OODA  loop  is  depicted  below. 


Observe 


Human  Sources 


Intelligence 


Orient 


m  Implied  Guidanoei 

and  Control 


Decide 

m  Implied  Guide 
and  Control 
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Orientation  indudes: 

-  Sense-making 

-  Managing  alternate  viewpoints 

-  Sharing  implicit  knowledge 

-  Managing  uncertainty  and  risk 

-  Developing  courses  of  action 

Decisions: 

-  Managing 
deliberation 

-  Fusing  information 

-  Choosing  what 
to  do  next 

_ ; _ _ 
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Action 


Unfolding 
Interadion 
,  With  Other  , 
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Figure  14.  The  Expanded  OODA  Loop  (From  Greene,  2007). 

With  respect  to  observations,  ECD  will  allow  the  tactical  analyst  to  observe  information, 
and  most  notably  trend  analysis,  in  a  different  approach.  This  approach  has  the  potential 
to  orient  the  commander’s  attention  to  specific  geographic  locations  and  track  insurgent 
trends.  Following  this  orientation  would  be  the  decision  to  deploy  forces  based  on  a 
fusion  of  intelligence  from  various  sources. 

5.  Tactical  Need 

Signals  intelligence  (SIGINT)  is  an  intelligence  discipline  where  the  collection  of 
raw  data  is  rarely  scarce,  and  more  accurately,  overly  abundant.  Having  the  manpower 
present  to  deal  with  this  dilemma  is  a  constant  struggle  within  the  SIGINT  community. 
Mr.  John  Abe  best  describes  this  in  a  situation: 

How  many  signals  are  active  in  a  200  mile  radius  surrounding  Frankfurt, 
Germany?  Hundreds?  Thousands?  Now,  add  one  more  signal  which 
happens  to  be  one  used  by  a  terrorist  communicating  with  other  members 
of  his  cell.  What  are  the  chances  of  detecting  the  new  signal  within  the 
first  few  seconds?  The  likelihood  of  detection  is  very  low.  In  fact, 
detecting  and  identifying  the  signal  as  new  is  very  unlikely  even  if  the 
signal  were  up  for  five  minutes  or  more.  (Abe,  2005) 
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A  technology  exists  that  will  have  a  significant  impact  on  not  only  SIGINT  specialists  but 
also  other  operational  units.  As  a  decision  support  tool  for  the  commander,  it 

•  Aids  SIGINT  analysts  in  determining  which  signals  are  important  and 
therefore  need  to  be  further  analyzed 

•  Assists  the  decision-maker  with  respect  to  force  selection  and  utilization. 

The  positive  impact  on  the  decision-maker  will  allow  for  more  informed  decisions  on 
employment  and  deployment  of  forces,  which  type  (kinetic  versus  non-kinetic  effects)  of 
forces  to  employ,  and  how  to  maximize  the  utilization  of  organic  intelligence  collection 
assets.  However,  like  all  technology,  it  must  be  properly  implemented  at  the  appropriate 
level  of  command  and  on  the  appropriate  information  dissemination  system. 

6.  Signals  Data  Collection  and  Storage 

This  section  is  located  in  a  classified  appendix. 

7.  Leavitt’s  Approach  to  Organizational  Change 

Harold  J.  Leavitt,  the  Walter  Kenneth  Kilpatrick  Professor  of  Organizational 
Behavior  emeritus  at  the  Stanford  Graduate  School  of  Business  and  a  “pioneer  in  the 
development  of  the  academic  field  of  organizational  behavior”  (Homgren,  2007).  His 
model  articulates  the  interrelationships  between  tasks,  structures,  personnel,  and 
technology  within  an  organization.  Figure  15  is  a  general  illustration  of  the  Leavitt 
Diamond. 


Structure 


Figure  15.  The  Leavitt  Diamond  (From  Homgren,  2009). 
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This  change  in  technology  will  affect  the  personnel  and  structural  organization,  along 
with  certain  tasks  that  must  be  accomplished.  Organization  and  workflow  optimization 
are  paramount  in  creating  a  streamlined  operating  procedure. 

The  focus  of  this  experiment  is  relocating  ECD  to  a  tactical  intelligence  center  in 
order  to  maximize  the  efficiency  of  organic  collection  assets  and  assist  the  commander  in 
maximizing  the  effectiveness  of  forces.  Consistent  with  Leavitt’s  model,  once  this 
relocation  occurs  (a  change  in  technology),  the  remaining  attributes  of  the  diamond  must 
be  reviewed,  and  most  likely  altered,  to  ensure  the  organization  is  optimized  with  respect 
to  efficiency  of  assets  and  effectiveness  of  forces.  This  reorganization  will  allow  for  the 
production  of  tactical  intelligence  in  a  timely  manner. 

B.  CURRENT  ENERGY  PROCESS  ARCHITECTURE 

For  all  intents  and  purposes,  the  current  process  architecture  can  be  simplified  and 
analyzed  as  a  two-phased  process.  Because  of  the  need  to  maintain  a  queue  for  the  RFIs, 
queuing  theory  is  also  used  for  analysis  purposes.  Appendix  A  diagrams  the  complexity 
of  the  process,  beginning  with  the  RFI  submittal  by  a  user  in  an  operational  theater.  The 
process  concludes  once  the  RFI  is  fulfilled  and  returned  to  the  originator. 

1.  RFI  Submittal  and  Reception 

The  first  phase  commences  when  an  RFI  is  submitted  from  theater  and  ends  when 
the  RFI  is  received  by  Analyst  1  (referred  to  as  Al).  Because  ECD  is  in  its  infancy,  it 
does  not  have  a  mature  operating  procedure,  and  therefore  resides  in  an  organization 
lacking  24/7  operations.  This  fact  is  detrimental  to  the  timeliness  of  the  entire  process 
and  is  one  reason  why  it  cannot  routinely  produce  tactical  intelligence. 

Since  this  organization  is  not  conducting  24/7  operations,  a  probabilistic  analysis 
of  when  the  RFI  is  actually  received  by  Al  is  necessary.  Al  works  from  0700  to  1700, 
Monday  through  Friday,  every  week.  Since  a  weekly  routine  is  the  first  periodic  unit  of 
measure  in  Al’s  work  cycle,  all  probabilistic  outcomes  will  be  in  reference  to  a  weekly 
schedule.  The  week  is  divided  into  168  hours  and  in  any  one  of  these  hourly  timeslots  an 
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RFI  may  be  sent  from  theater  to  arrive  in  Al’s  inbox  within  minutes.  All  hourly 
timeslots,  their  associated  latency  for  RFI  reception,  frequency  of  occurrence  in  a  given 
week,  and  probability  are  presented  in  Appendix  B. 

The  first  step  is  finding  the  probability  of  A1  receiving  an  RFI  during  normal 
working  hours.  Since  A1  works  ten  hours  per  day,  there  are  fifty  hours  per  week  in 
which  A1  receives  an  RFI  within  one  hour.  These  are  considered  the  best  case  scenarios 
because  the  latency  due  to  an  RFI  sitting  in  a  queue  is  minimal.  “Within  the  hour” 
assumes  that  A1  has  other  distractions  (coffee  breaks,  bathroom  breaks,  lunch,  etc.)  and 
daily  tasks  of  a  higher  priority.  Making  these  assumptions,  an  RFI  received  within  one 
hour  of  A1  arriving  to  work  will  also  be  included  with  normal  working  hours.  This 
means  there  are  fifty-five  hourly  slots  per  week  in  which  an  RFI  will  be  received  during 
normal  working  hours. 

The  next-best  case  scenario  is  when  and  RFI  is  submitted  during  non-working 
hours  from  Sunday  evening  through  Thursday  evening.  His  scenario  is  when  an  RFI  is 
received  after  the  close  of  the  business  day  with  the  next  day  being  a  normal  business 
day.  If  an  RFI  is  received  during  this  time  period,  a  latency  of  anywhere  from  one  to 
fourteen  hours  is  possible.  There  are  thirteen  hours  a  day  for  five  days  during  a  normal 
working  week  where  this  is  the  case.  This  scenario  accounts  for  sixty-five  hourly  slots 
per  week. 

The  remaining  forty-eight  slots  occur  over  the  weekend;  from  1700  Friday 
evening  through  Sunday  afternoon.  This  is  the  worst-case  scenario  where  the  latency 
range  is  from  fourteen  to  sixty-two  hours  before  A1  receives  the  RFI.  Table  4  is  the 
probability  distribution  per  hour  during  one  week  when  an  RFI  could  be  received. 
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Frequency  of  Weekly  RFI  Reception 


1  4  7  101316192225283134374043464952555861 
Hourly  Time  Interval 

Table  4.  Probability  Distribution  for  Weekly  RFI  Reception. 

The  table  shows  a  large  discrepancies  of  possible  values;  an  RFI  can  be  received 
anywhere  from  within  the  first  hour  it  was  sent  to  sixty-two  hours  afterwards.  Three 
focus  areas  are  observed  relating  to  the  three  scenarios  described  above.  What  is  not 
overtly  obvious  from  the  previous  table  is  that  these  areas  are  relatively  equal  time 
distributions.  Figure  16  is  a  visual  representation  of  the  time  distribution  into  these 
distinct  categories. 


Figure  16.  Scenarios  of  RFI  Reception. 


From  this  pie  chart,  one  can  clearly  see  that  the  probability  of  RFI  reception 
within  one  hour,  between  two  and  fourteen  hours,  and  greater  than  fourteen  hours  are 
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relatively  equal.  That  is  to  say,  if  an  RFI  was  submitted  at  a  random  time,  that  RFI  has 
approximately  33%  probability  of  falling  into  any  of  the  three  scenarios.  As  previously 
stated,  this  latency  in  time  is  not  a  characteristic  of  tactical  intelligence;  and  therefore 
needs  to  be  eliminated. 

From  a  probability  distribution,  an  expected  value  can  be  determined.  This 
expected  value  is  more  commonly  referred  to  as  the  average,  or  mean.  The  mean  value  is 
also  denoted  as  p.  The  expected  value,  E(X),  is  computed  by  (Balakrishnan,  2007). 3 

E(X)  =  fJX,P(Xi)  (2.1) 

i= 1 

In  this  equation,  X  is  the  time  interval  required  before  an  RFI  is  received  and  P(X) 
is  the  probability  of  RFI  reception  during  the  time  interval  X.  X  and  P(X)  for  this  phase 
are  located  in  Appendix  A.  The  expected  value  of  X  is  14.4  hours. 

Associated  with  the  expected  value  of  a  probability  distribution  is  the  variance 
and  standard  deviation.  Variance  is  defined  as 

Variance  =  a2  =  YJ[Xi -E(X)]2P(Xi)  (2.2) 

i=i 

and  the  standard  deviation  is  the  square  root  of  the  variance,  denoted  as  a.  For  phase  one 
of  the  current  process,  the  variance  is  300.8  and  the  standard  deviation  is  17  hours  and  21 
minutes.  A  large  a  is  indicative  of  a  well  spread  probability  spectrum  and  degrades  the 
importance  of  the  mean  value.  In  this  case,  a  is  larger  than  p.  Falling  within  one  a  of 
the  mean  value  accounts  for  approximately  68.26%  of  all  values  of  X.  For  this  phase, 
falling  within  one  a  of  the  mean  value  is  anywhere  between  zero  (cannot  account  for 
negative  time)  and  3 1  hours  and  45  minutes  to  receive  an  RFI.  The  following  table  is  an 
area  visualization  of  the  probability  distribution  with  the  mean  (red  dashed  line)  and  one 
standard  deviation  (yellow  dashed  line)  clearly  outlined. 


3  All  equations  throughout  Chapter  II  and  III,  unless  otherwise  stated,  are  from  this  source. 
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Current  Process  Phase  1 :  RFI  Reception 


Figure  17.  Phase  1  Probability  of  RFI  Reception. 

2.  Analysis  and  RFI  Fulfillment 

The  second  phase  of  the  current  process  begins  once  the  RFI  is  received  by  A1 
and  concludes  once  the  RFI  is  fulfilled  and  sent  back  to  the  RFI  originator.  This  process 
is  quite  complex  and  involves  interactions  between  A1  and  Analyst  2  (referred  to  as  A2) 
and  is  diagramed  in  Appendix  A.  This  phase  is  also  known  as  the  production  and 
dissemination  phase. 

Once  an  RFI  is  received,  A1  sends  the  RFI  to  A2  so  that  A2  can  setup  the 
equipment  to  conform  to  what  type  of  information  is  requested.  Once  the  equipment 
setup  is  complete,  A2  creates  the  desired  report.  This  report  is  sent  to  A1  who  reviews 
the  report,  checks  it  for  accuracy,  and  formats  the  report  per  the  RFI.  Once  formatted,  A1 
sends  the  requested  information  to  the  RFI  originator. 

In  discussing  the  process  during  initial  review,  A1  declared  that  an  RFI  can  be 
fulfilled  (once  received)  anywhere  from  twenty  minutes  to  six  hours.  Instead  of 
analyzing  each  individual  interaction  between  A1  and  A2,  it  is  sufficient  for  the  purpose 
of  this  analysis  to  view  the  second  phase  as  one  process.  This  is  because  the  time  scale  is 
much  smaller  than  the  time  scale  of  the  first  phase  (minutes  vice  hours).  Since  the 
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latency  of  the  overall  process  is  of  greatest  importance,  the  individual  interactions  do  not 
need  to  all  be  considered.  However,  priority  of  request  will  be  considered  when 
discussing  queuing  theory. 

Since  an  RFI  can  be  fulfilled  anywhere  within  twenty  minutes  and  six  hours 
(based  on  priority  of  request  and  other  daily  tasks),  it  is  safe  to  assume  a  general 
distribution  of  this  phase.  With  the  given  range  and  knowledge  of  the  work  ethic  A1  and 
A2  possess,  p  is  assumed  to  be  120  minutes,  or  two  hours.  Collaborating  with  A 1,  a  a  of 
forty-five  minutes  is  accurate,  meaning  68.26%  of  all  RFIs  are  fulfilled  between  75 
minutes  (one  hour  and  fifteen  minutes)  and  165  minutes  (two  hours  and  forty- five 
minutes).  Figure  18  shows  the  normal  distribution  of  this  phase  with  the  mean  (red 
dashed  line)  and  one  standard  deviation  (yellow  dashed  line)  clearly  outlined. 


Figure  18.  Phase  2  Normal  Distribution. 


3.  Total  Latency  in  the  Current  Process  Architecture 

The  combination  of  both  phases  corresponds  to  the  total  latency  of  the  current 
architecture.  A  simple  summation  of  the  mean  values  and  variances  from  both  phases  is 
sufficient  to  describe  the  entire  process. 

Htotal  -  jU\  +  jU2-  \4Ahours  +  Ihours  =  1 6Ahours  (2.3) 


27 


(2.4) 


Variancetotal  =  cr,2  +  a2  =  300.8  +  ( 2e~ 5)  =  300.8 
From  the  variance,  the  overall  a  can  be  calculated  by 

cr  =  ^Variance total  =  \1.3hours  (2.5) 

The  following  figure  is  the  probability  distribution  curve  of  the  entire  process  with  the 
mean  (red  dashed  line)  and  one  standard  deviation  (yellow  dashed  line)  clearly  outlined. 


Figure  19.  Overall  Probability  Distribution. 


It  is  evident  from  these  calculations  that  the  system  is  not  tailored  for  tactical 
intelligence  dissemination.  In  a  best-case  scenario;  however,  an  RFI  may  be  fulfilled  and 
disseminated  within  an  hour,  and  therefore  would  aid  a  tactical  military  commander. 
These  instances  would  rarely  occur,  and  most  likely  only  be  used  for  an  RFI  of  the 
highest  priority.  An  example  of  this  would  be  a  time-sensitive  target  of  a  high-value 
individual.  This  RFI  would  come  from  the  highest  level  of  authority,  and  would  be  the 
focus  of  effort  for  both  A1  and  A2. 

Currently,  high  priority  tactical  operations  may  occur  simultaneously  in  multiple 
theaters.  Because  there  are  only  two  dedicated  analysts,  they  may  only  be  able  to  assist 
one  of  the  operations.  Thus  far,  the  mean  values  and  standard  deviations  have  all  been 
calculated  based  on  one  RFI.  What  if  more  than  one  RFI  is  received  within  a  given 
timeframe?  This  is  the  case  with  the  current  process,  and  queuing  theory  needs  to  be 
analyzed. 
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4.  Queuing  Theory 

In  order  to  apply  the  correct  queuing  model,  various  assumptions  must  be  made. 
These  assumptions  are  (Balakrishnan,  2007): 

•  Arrivals  that  follow  the  Poisson  probability  distribution. 

•  First  in,  first  out  (FIFO)  queue  discipline. 

•  A  single-phase  service  facility. 

•  Infinite,  or  unlimited  queue  length.  That  is,  the  fourth  symbol  in  Kendall’s 
notation  is  oo. 

•  Service  systems  that  operate  under  steady,  ongoing  conditions.  This 
means  that  both  arrival  rates  and  service  rates  remain  stable  during  the 
analysis. 

Poisson  probability  distribution  has  assumptions  discussed  in  the  following 
section.  FIFO,  for  the  purpose  of  this  analysis,  is  assumed.  This  assumption  has  been 
confirmed  by  Al.  There  are  instances  where  FIFO  is  not  followed;  an  example  is  when  a 
high  priority  operation  is  being  planned.  When  this  occurs,  all  analysts  are  dedicated  to 
this  operation,  disregarding  FIFO.  However,  these  occurrences  are  rare  enough  that  over 
a  long  enough  period  of  time,  FIFO  is  the  mean  behavior. 

Because  all  the  processes  involved  are  linear  and  dependent  on  completion  of  the 
previous  process,  it  can  be  assumed  a  single-phase  facility.  Similar  to  the  rationale  for 
FIFO,  occurrences  where  this  process  is  viewed  as  multi-phased  are  limited  and  scarce. 
There  is  no  limit  to  the  RFI  queue. 

Steady  state  conditions  are  assumed  over  the  entire  analysis.  The  state  of  military 
operations  throughout  the  world  will  dictate  the  definition  of  steady  state  condition. 
Current  operations  have  been  ongoing  well  before  the  beginning  of  this  analysis  and  can 
be  considered  steady  state.  Before  these  assumptions  are  verified,  the  Poisson  probability 
distribution  and  Kendall’s  notation  are  discussed. 
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a.  Arrival  Characteristic — Poisson  Probability  Distribution 

Confirmation  of  four  assumptions  is  necessary  to  utilize  the  Poisson 
probability  distribution.  These  assumptions  are  (Balakrishnan,  2007): 


•  The  average  arrival  rate  (X)  over  a  given  interval  is  known. 

•  This  average  rate  is  the  same  for  all  equal-sized  intervals. 

•  The  actual  number  of  arrivals  in  one  interval  has  no  bearing  on  the 
actual  number  of  arrivals  in  another  interval. 

•  There  cannot  be  more  than  one  arrival  in  an  interval  as  the  size  of 
the  interval  approaches  zero. 


All  these  assumptions  are  valid  for  the  current  process  and  the  discrete  Poisson 
distribution  is  provided  by  the  following  formula 

*AX 


P(X): 


X! 


(2.6) 


where  X  is  the  number  of  arrivals  per  unit  time,  P(X)  is  the  probability  of  exactly  X 
arrivals,  X  is  the  average  arrival  rate,  and  e  is  the  exponential  constant.  In  order  for  this 
formula  to  be  accurate  for  the  current  process,  X  must  be  defined. 


From  2008  historical  data,  1,045  RFIs  were  submitted  and  fulfilled. 
Dividing  the  number  of  RFIs  per  year  by  the  number  of  days  per  year  produces  about 
2.86  RFIs  received  per  day;  or  twenty  received  per  week.  Since  the  unit  of  time  used  is  a 
week,  X  equals  twenty.  Figure  20  is  the  Poisson  distribution  for  the  current  process. 
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Figure  20.  Poisson  Distribution  for  the  Current  Process. 


b.  Queuing  System  Characteristics — Kendall’s  Notation 


In  queuing  theory,  there  is  a  commonly  used  three-  or  five- symbol 
notation  to  organize  the  various  types  of  systems.  The  notation  is  defined  as 
(Balakrishnan,  2007)4: 

A/B/s. 


Where 


•  A  =  the  arrival  probability  distribution.  Typical  choices  are  M 
(Markovian)  for  a  Poisson  distribution,  D  for  a  constant  or 
deterministic  distribution,  or  G  for  a  general  distribution  with 
known  mean  and  variance. 

•  B  =  the  service  time  probability  distribution.  Typical  choices  are 
M  for  an  exponential  distribution,  D  for  a  constant  or  deterministic 
distribution,  or  G  for  a  general  distribution  with  known  mean  and 
variance. 

•  s  =  the  number  of  servers. 

4  Balakrishnan  uses  the  three-symbol  vice  the  five-symbol  notation.  Only  three-symbol  notation  will 
be  used  throughout  this  thesis. 
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The  last  two  symbols  identify  the  maximum  allowable  length  of  the  queue  and  the  size  of 
the  arrival  population.  The  omission  of  these  two  symbols  implies  both  criteria  tend 
towards  infinity  (Balakrishnan,  2007). 

The  current  process  is  best  represented  by  an  M/G/l  system.  As  stated 
above,  the  arrival  of  RFIs  is  a  Poisson  probability  distribution,  the  service  time  is 
represented  by  a  general  distribution  with  a  known  (assumed)  mean  and  variance,  and  the 
number  of  servers  is  singular.  The  product  A1  and  A2  collectively  assemble  is  a  linear 
process  and  thus  represented  as  a  single  server.  Multi-servers  indicate  that  an  RFI  would 
go  to  either  A1  or  A2  for  fulfillment,  and  this  is  not  the  case. 


c.  Queuing  Computations  for  the  Current  Process  Architecture 

For  computations  involving  an  M/G/l  system,  the  average  number  of 
arrivals  per  time  period  (A,),  the  average  number  of  people  or  items  served  (y),  and  the 
standard  deviation  (a)  are  essential.  From  previous  calculations,  A  =  20  arrivals  per 
week,  \\t  =  21  products  per  week,  and  a  =  0.75  hours  (0.00446  weeks).  It  is  important  to 
note  that  the  service  rate  must  be  greater  than  the  arrival  rate,  otherwise  the  queue  would 
tend  towards  infinity.  With  these  values  of  A,  \|/,  and  a,  the  following  six  computations 
encompass  the  operating  characteristics  of  this  M/G/l  model  (Balakrishnan,  2007): 


Average  server  utilization  time: 

p  =  —  =  0.952  =  95.2%  (2.7) 

V 

Average  number  of  customers  or  units  waiting  in  line  for  service: 

l2  2  .  2 

L= - —  =  9.1  (2.8) 

*  2(1  ~P) 

Average  number  of  customers  or  units  in  the  system: 

L  =  Lq+p  =  10.05  (2.9) 

Average  time  a  customer  or  unit  spends  waiting  in  line  for  service: 

L 

Wq=  —  =  0.455 weeks  =  3.2days  (2.10) 

A 

Average  time  a  customer  or  unit  spends  in  the  system: 
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(2.11) 


W  =  Wq+  (^j/ )  =  0.5  weeks  =  3.5  days 

Probability  that  there  are  zero  customers  or  units  in  the  system: 

^=1-^  =  0.048  =  48%  (2.12) 

From  these  calculations,  the  current  process  maintains  about  nine  RFIs  in 
the  queue  at  any  given  time,  and  total  of  ten  RFIs  (nine  in  the  queue  and  one  in 
production)  are  constantly  in  the  system.  The  average  server  utilization  time  describes 
the  amount  of  time  that  A1  and  A2  are  working  an  RFI.  Because  there  are  other  daily 
tasks  associated  with  their  jobs,  the  other  tasks  have  already  been  taken  into  account 
when  calculating  the  second  phase  of  the  current  process.  Po  conveys  that  the  model  has 
a  low  probability  (less  than  five  percent)  of  ever  being  void  of  RFIs  that  require  attention. 

The  values  of  Wq  and  W  reveal  the  true  message  of  the  current  ECD 
process  analysis.  Unless  there  is  a  high  priority  operation,  an  RFI  will  spend  in  excess  of 
three  and  a  half  days  in  the  system.  This  calculated  value  is  optimistic  because  A1  stated 
that  the  average  time  to  fulfill  an  RFI  was  approximately  five  days.  This  latency  in 
fulfillment  is  not  suitable  for  an  RFI  to  be  submitted  with  the  intent  of  providing  tactical 
intelligence,  since  actionable  tactical  intelligence  is  associated  with  timeliness.  The 
proposed  architecture  will  provide  users  with  all  the  same  intelligence  they  can  currently 
acquire  through  submission  of  an  RFI,  but  will  also  include  a  capability  to  acquire  timely 
intelligence  to  provide  useful  insight  to  tactical  commanders  prior  to  conducting 
operations;  no  matter  how  high  the  priority  of  the  operation. 

C.  SUMMARY  AND  CONCLUSIONS 

The  current  process  architecture  cannot  provide  timely  intelligence  to  a  tactical 
user  nor  can  it  fulfill  a  high  volume  of  RFIs  based  on  the  personnel  and  organizational 
structure.  This  initial  structure  served  as  the  experimental  test  bed  for  this  technology. 
Now,  the  technology  has  proven  useful  and  requires  a  mature  operating  procedure  to 
efficiently  service  users  at  every  level  of  warfare.  The  following  characteristics  of  the 
current  process  are  areas  of  possible  improvement  with  respect  to  the  production  of 
tactical  intelligence. 


33 


The  current  process  was  established  as  a  test  bed  for  verification  and  validation  of 
ECD  technology.  While  ECD  has  proven  useful  to  fulfilling  RFIs  on  the  time  scale 
involving  days,  a  timeline  on  the  order  of  hours  and  minutes  is  not  feasible  in  the  current 
architecture.  Appendix  C  is  a  PowerPoint  presentation,  created  by  the  author,  given  to  a 
senior  executive  with  the  intent  of  demonstrating  the  feasibility  and  tactical  utility  of 
ECD.  The  presentation  was  given  on  February  26th,  2009.  The  following  five  sections 
list  and  explain  the  areas  of  latency  in  the  current  process.  Providing  senior  leadership 
metrics  and  avenues  of  improvement  will  allow  for  funding  and  expedited 
implementation  of  this  technology  at  the  tactical  level  in  support  of  the  GWOT. 

1.  Information  versus  Intelligence 

Differentiating  between  information  and  intelligence  has  been  done  in  a  previous 
section.  Currently,  an  RFI  must  be  fulfilled  with  a  fully  vetted  intelligence  report,  with 
few  exceptions.  This  is  not  driven  by  policy,  but  is  a  function  of  what  information  a 
specific  RFI  is  requesting.  An  intelligence  report  is  more  time  consuming  than  merely 
providing  information  to  the  requestor,  because  intelligence  requires  a  certain  level  of 
analysis.  In  many  cases,  if  just  the  information  was  provided  to  the  RFI  originator,  that 
unit  can  conduct  its  own  analysis  and  produce  its  own  intelligence.  There  are  situations 
where  a  military  unit  has  the  organic  intelligence  assets  necessary  to  gather  their  own 
intelligence  with  a  “tip  off’  from  the  information  provided  by  the  strategic  operations 
center.  These  changes  would  allow  for  a  higher  volume  of  RFIs  to  be  fulfilled  and 
decrease  the  amount  of  time  it  takes  to  fulfill  a  request. 

2.  “Pushing”  versus  “Pulling”  Information 

In  order  for  the  current  process  to  initiate,  the  system  requires  submittal  of  an  RFI 
via  a  member  of  the  tactical  unit  in  a  theater  of  operations  whom  desires  the  information 
(the  RFI  originator).  Before  an  RFI  is  submitted,  the  RFI  originator  needs  access  to  the 
Joint  Worldwide  Intelligence  Communications  System  (JWICS)  and  an  understanding  of: 

•  The  observed  intelligence  gap  that  could  be  detrimental  to  mission 
success. 
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•  What  information  is  required  to  fulfill  this  gap. 

•  The  capabilities  and  limitations  of  this  technology. 

•  The  EM  spectrum  and  what  information  it  can  provide. 

Once  all  these  stipulations  are  met,  than  the  tactical  unit  “pushes”  an  RFI  to  the 
operations  center  where  this  technology  currently  resides.  Once  A1  and  A2  complete  the 
necessary  analysis  to  fulfill  the  RFI,  the  final  intelligence  product  is  than  “pushed”  back 
to  the  RFI  originator.  This  is  equivalent  to  having  to  “pull”  the  required  information 
from  the  operations  center.  If  there  is  any  rework  required,  or  the  findings  of  the  RFI 
give  birth  to  new  questions,  than  another  RFI  must  be  submitted. 

A  solution  to  decrease  the  latency  in  the  process  would  be  to  constantly  “push” 
the  information  to  units  at  all  levels  periodically,  partitioning  the  information  based  on 
geo-location  of  the  military  unit.  If  military  units  were  periodically  receiving  pertinent 
information  based  on  their  area  of  operations,  their  indigenous  intelligence  cell  could,  in 
most  cases,  provide  the  required  analysis  on  the  information  to  provide  timely  and 
actionable  intelligence  to  the  commander.  This  information  would  also  provide  the 
intelligence  cell  information  necessary  to  more  efficiently  focus  their  organic  intelligence 
collection  assets. 

3.  Bottleneck 

Anyone  worldwide,  with  access  to  JWICS  (or  access  to  a  HHQ  with  JWICS),  can 
submit  an  RFI.  Since  there  are  only  two  analysts  currently  assigned  to  this  technology, 
an  informational  bottleneck  occurs.  Tactical  operations  in  various  theaters  across  the 
globe  prioritize  intelligence  requests  based  on  the  current  mission  in  their  respective 
theater.  Different  theaters  have  a  higher  priority  than  others.  Since  all  the  RFIs  are  sent 
to  a  single  strategic-level  operations  center  and  placed  in  a  queue,  the  relative  importance 
of  the  information  requested  does  not  matter.  An  obvious  exception  to  the  rule  would  be 
a  tactical  operation  with  strategic  implications,  and  this  category  of  operation  is  usually 
time-sensitive.  Even  though  an  RFI  in  one  theater  might  be  of  higher  priority  than 
another  RFI  in  a  separate  theater  does  not  mean  the  queue  will  acknowledge  this,  unless 
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(as  previously  stated)  there  are  strategic  level  implications.  There  needs  to  be  a  way  to 
geographically  separate  the  information  in  order  to  prioritize  requests. 

4.  Human-in-the-Loop 

Human  analysis  at  the  strategic  level  is  not  necessary  if  ECD  is  located  at  the 
tactical  level.  Once  ECD  “pushes”  the  information  to  the  tactical  user,  organic 
intelligence  analysts  can  use  the  information  appropriately.  Eliminating  the  need  to 
produce  fully  vetted  intelligence  reports  creates  an  architecture  where  the  human 
involvement  tends  to  zero;  except  for  when  the  information  needs  to  be  analyzed. 
Implying  that  the  human  can  be  fully  removed  from  the  model  is  incorrect,  as  there  will 
always  need  to  be  someone  conducting  routine  and  ad  hoc  maintenance  on  the  hardware. 
However,  for  the  purpose  of  this  thesis,  complete  removal  of  the  human-in-the-loop  with 
respect  to  daily  tasks  is  possible,  and  recommended.  Again,  this  can  only  be 
recommended  if  the  final  ECD  product  is  not  a  vetted  intelligence  report,  but  an 
information  “push.” 

5.  Clearance  and  Access 

Currently,  ECD  only  resides  on  JWICS.  This  limits  the  number  of  potential  users 
to  only  those  who  have  the  appropriate  clearance  level  and  access  to  high-side  systems. 
This  is  not  always  the  case  in  an  operational  environment.  A  common  axiom  realized  by 
military  veterans  of  Operation:  IRAQI  FREEDOM  and  Operation:  ENDURING 
FREEDOM  (OIF  and  OEF)  is  that  “the  war  is  fought  on  the  SIPRNet.” 

During  OIF,  the  author  was  deployed  to  a  forward  operating  base  (FOB),  which 
did  not  have  direct  access  to  JWICS.  If  ECD  was  available  on  JWICS  during  this 
deployment,  the  author  would  have  needed  to  send  an  RFI  to  his  higher  headquarters 
(HHQ),  who  in  turn  would  have  had  to  send  the  ECD  RFI  back  to  CONUS.  Once  the 
RFI  was  fulfilled,  it  would  have  been  sent  back  to  HHQ  who  would  then  have  to  reformat 
the  product  to  transfer  from  JWICS  to  Secret  Internet  Protocol  Router  Network 
(SIPRNet).  Once  reformatted,  then  it  could  have  been  sent  back  to  the  author,  with 
obvious  time  delays.  There  are  obvious  time  delays  with  the  extra  steps  detailed  above. 
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The  scenario  described  above  would  not  have  been  feasible  to  produce  tactical 
intelligence  for  the  author.  However,  if  ECD  resides  on  JWICS  and  the  SIPRNet,  the 
potential  number  of  users  would  increase.  If  the  war  is  fought  on  the  SIPRNet,  then  ECD 
should  be  applied  appropriately. 


37 


THIS  PAGE  INTENTIONALLY  LEFT  BLANK 


38 


III.  PROPOSED  ENERGY  PROCESS  ARCHITECTURE 


A.  OVERVIEW 

The  proposed  process  will  mitigate  many  of  the  sources  of  latency  detailed  in  the 
previous  section  in  order  to  allow  for  the  production  of  tactical  intelligence.  ECD  will 
also  be  a  tool  which  the  tactical  commander  can  use  to  pull  timely  and  actionable 
information.  Cloud  computing  is  the  backbone  of  the  proposed  solution  with  various 
regional  hubs  with  service  to  distinct  areas  of  operations. 

1.  Database  and  Storage 

The  data  stored  and  archived  in  the  database  will  be  geographically  partitioned 
into  various  regions  of  the  world.  This  is  a  shift  from  the  classic  hub  and  spoke  model, 
seen  in  Figure  21,  to  a  more  distributed  hybrid  of  a  hub  and  spoke  model. 


Figure  21 .  Hub  and  Spoke  Database  Architecture. 

In  the  hybrid  model,  the  databases  are  geographically  disbursed  and  interconnected  with 
all  other  database  hubs.  Users  at  each  geographic  location  will  have  access  to  all 
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pertinent  data.  The  hybrid  database  architecture  alleviates  the  bottleneck,  described  in 
Chapter  II,  of  worldwide  users  requesting  information  from  one  database.  Displayed  in 
the  next  figure  is  the  hybrid  architecture  concept. 


Figure  22.  Hybrid  Hub  and  Spoke  Database  Architecture. 


Also  evident  from  the  above  figure  is  the  number  of  users  who  can  have  simultaneous 
access  to  the  data.  Multiple  users  in  multiple  theaters  may  now  use  the  data  for 
informational  and  intelligence  purposes  without  submitting  an  RFI  to  CONUS.  This  data 
“push”  to  various  locales  worldwide  versus  the  RFI  submittal  process  was  noted  as  one  of 
the  sources  of  hindering  tactical  intelligence  production. 

The  current  architecture  resides  on  JWICS.  The  proposed  architecture  also 
resides  on  JWICS;  however,  it  also  has  a  mirrored  architecture  on  the  SIPRNet.  Figure 
23  shows  two  hybrid  architectures,  one  for  each  information  dissemination  system.  This 
model  shows  that  every  node  with  JWICS  access  will  also  have  SIPRNet  access. 
However,  the  converse  is  not  true.  There  are  many  locations  in  support  of  OIF  and  OEF 
where  there  is  SIPRNet  acces,  but  no  JWICS  access.  These  two  dissemination  systems 
are  not  linked  and  have  no  cross-domain  transfer  capability. 
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Figure  23.  The  Proposed  SIPRNet  (Red)  and  JWICS  (Orange)  Architectures. 

Another  observation  of  the  current  architecture  was  that  ECD  is  limited  to  JWICS 
users.  Existing  on  the  SIPRNet  will  provide  access  to  more  users  simply  because  more 
personnel  have  secret  clearances.  The  overlap  seen  above  demonstrates  that  not  all 
regional  hubs  will  have  access  to  JWICS.  Some  areas  or  operations  are  too  remote  for 
JWICS  access.  No  matter  how  remote,  military  personnel  should  have  access  to  the 
information  ECD  provides. 

A  level  of  fidelity  is  lost  in  the  data  that  resides  on  JWICS  and  also  resides  on  the 
SIPRNet.  However,  the  relevant  data  necessary  for  the  tactical  commander  to  use  in 
determining  the  employment  and  deployment  of  forces  is  contained  in  the  SIPRNet 
database.  What  is  lost  is  the  ability  to  conduct  an  in-depth  analysis  of  the  signals  of 
interest.  The  equipment  necessary  for  a  more  comprehensive  analysis  only  resides  with 
units  that  have  direct  access  JWICS.  The  tactical  commander  would  have  the  reach-back 
capability  to  HHQ  with  JWICS,  if  the  need  for  this  level  of  analysis  exists. 
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2. 


Cloud  Computing 


Cloud  computing  has  an  abundance  of  definitions.  This  is  a  fairly  new  and 
evolving  technology  and  is  integrated  into  the  database  architecture  in  the  above  section. 
As  Erdogmus  states: 

According  to  Wikipedia,  cloud  computing  refers  to  the  use  of  scalable, 
real-time,  Internet-based  IT  services  and  resources,  incorporating  beyond 
[software  as  a  service]  many  key  technology  trends  of  the  2000s.  These 
trends  include  .  .  .  service-oriented  architecture,  application  service 
provision,  Web  2.0,  Web  services,  mash-ups,  utility  computing,  autonomic 
computing,  grid  computing,  on-demand  computing,  and  so  on.  .  .  . 
Matthieu  Hug’s  alternative  definition  on  InfoQ  (www.infoq.com/articles/will- 
meis-replace-extranets)  is  .  .  .  “an  emerging  computing  paradigm  where  data 
and  services  reside  in  massively  scalable  data  centers  and  can  be 
ubiquitously  accessed  from  any  connected  devices  over  the  Internet. 
(Erdogmus,  2009) 

These  varying  definitions  provoked  Erdogmus  to  ask  a  “cloud-computing  pundit  for  the 
real  story:  Marin  Litoiu  of  York  University”  and  as  maintained  by  Litoiu,  “cloud 
computing  is  an  emerging  computational  model  in  which  applications,  data,  and  IT 
resources  are  provided  as  services  to  users  over  the  Web”  (Erdogmus,  2009). 

Important  to  note  is  that  the  proposed  database  architecture  and  integration  of 
cloud  computing  is  already  occurring.  It  is  not  the  intent  of  the  author  to  be  credited  with 
the  transformation  to  cloud  computing,  for  that  transformation  is  independent  of  ECD. 
ECD  will  be  one  of  many  applications.  For  all  intents  and  purposes,  this  thesis  focuses 
on  an  ECD  application  as  the  proposed  solution  that  will  exist  in  “the  cloud.” 

3.  ECD  Application 

As  an  application,  the  user  will  see  two  main  sections  on  the  computer  monitor. 
These  two  sections  are  the  query  window  and  map.  The  map  will  display  the  geographic 
area  of  interest  and  can  be  zoomed  in  and  out.  The  query  window  will  allow  the  SIGINT 
analyst  to  focus  on  particular  signals  of  interest  (SOIs)  within  a  given  time  interval.  The 
actual  query  sets  are  not  listed  here  due  to  classification.  The  following  figure  is  a 
cartoon  rendition  of  the  ECD  application  graphical  user  interface. 


42 


Figure  24.  ECD  Application  Graphical  User  Interface. 


4.  Required  Training 

With  the  introduction  of  any  new  technology,  a  training  regimen  must  be  crafted 
concurrently  in  order  to  increase  the  effectiveness  of  said  technology  to  the  specific 
organization.  This  is  a  major  pillar  in  Leavitt’s  Diamond  and  described  in  Chapter  II. 
The  details  of  the  training  process  will  be  assembled  by  the  SIGINT  professionals  whom 
currently  are  testing  ECD  and  are  not  in  the  realm  of  this  thesis;  the  author  does  not  have 
the  technical  expertise  or  background  to  create  this  training  curriculum. 


5.  Latency  and  Queuing  Theory 

a.  Total  Latency  for  the  Proposed  Process  Architecture 

The  proposed  process  can  be  viewed  as  a  single  phase  system  conducting 
around-the-clock  operations.  ECD  will  be  operational  24  hours  per  day  by  a  single 
individual.  Current  military  operations  mainly  use  either  two  12-hour  shifts  or  three  8- 
hour  shifts  by  individuals  to  cover  24  hour  manning.  Slightly  compressing  the  timeline 
from  the  current  process  proposed  by  A1  and  A2  is  possible  due  to: 

•  The  analyst’s  familiarization  of  the  EM  environment  in  a  given 
area  of  operations. 

•  Focus  on  a  relatively  small  (versus  worldwide)  geographic  area. 
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•  The  analyst’s  speed  and  efficiency  due  to  constant  exposure  to  the 
ECD  tool. 

For  the  proposed  process,  p  is  assumed  to  be  105  minutes,  or  one  hour  and  forty- five 
minutes  and  a  is  also  compressed  to  thirty  minutes.  This  means  68.26%  of  all  products 
are  disseminated  between  75  minutes  (one  hour  and  fifteen  minutes)  and  135  minutes 
(two  hours  and  fifteen  minutes).  Figure  25  shows  the  normal  distribution  of  this  phase 
with  the  mean  (red  dashed  line)  and  one  standard  deviation  (yellow  dashed  line)  clearly 
outlined. 


Total  Proposed  Process 


1  15  29  43  57  71  85  99  113  127  141  155  169  183  197 

Time  (Minutes) 

Figure  25.  Proposed  Process  Normal  Distribution. 

b.  Queuing  Computations  for  the  Proposed  Process  Architecture 

The  proposed  process  is  best  represented  by  an  M/G/l  system,  as  is  the 
current  process.  The  average  number  of  people  or  items  served  (vp)  is  computed  by 
taking  the  average  time  to  produce  an  artifact  based  on  a  24-hour  operations  center.  At 
the  average  time  of  105  minutes,  just  over  thirteen  requests  per  day  could  be  fulfilled. 
Understanding  that  some  requests  would  require  more  analysis,  \p  =  12  products  per  day 
or  84  products  per  week.  Since  the  average  number  of  arrivals  per  time  period  ( X )  must 
be  less  than  \p,  a  value  of  1 1  products  per  day  (77  products  per  week)  is  reasonable.  This 
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value  for  A  is  also  defendable  due  to  the  high  operational  tempo  of  a  24  hour  tactical 
intelligence  cell.  The  standard  deviation  was  compressed  from  45  to  30  minutes, 
meaning  a  =  0.5  hours  (0.00298  weeks).  All  calculations  will  be  in  the  same  units  as 
those  derived  in  Chapter  II  for  comparison  purposes.  With  these  values  of  A,  \| /,  and  a, 
the  following  six  computations  encompass  the  operating  characteristics  of  this  model: 


Average  server  utilization  time: 

p  =  —  =  0.917  =  91.7% 

¥ 

Average  number  of  customers  or  units  waiting  in  line  for  service: 

lV+^54 

'  2(1  -  p) 

Average  number  of  customers  or  units  in  the  system: 

L  =  Lq+p  =  6. 32 

Average  time  a  customer  or  unit  spends  waiting  in  line  for  service: 
L 

Wq=  —  =  0.1 07  weeks  =  0.49  days  =  \\.16hours 
A, 


Average  time  a  customer  or  unit  spends  in  the  system: 

W  =  Wq  +  (^/ )  =  0.082 weeAs  =  0.57  days  =  \3.16hours 

Probability  that  there  are  zero  customers  or  units  in  the  system: 
p0=\-p  =  0.083  =  8.3% 


(3.1) 

(3.2) 

(3.3) 

(3.4) 

(3.5) 

(3.6) 


From  these  calculations,  it  is  evident  that  the  queue  has  been  reduced  by 
an  order  of  magnitude  (hours  vice  weeks).  However,  it  is  not  evident  that  tactical 
intelligence  production  is  a  common  capability  with  a  queue  time  of  than  double  what  the 
author  has  determined  as  acceptable  for  tactical  intelligence  production.5  This  length  of 
time  spent  in  the  system  (13.76  hours)  is  a  result  of  assuming  that  the  SIGINT  analysts 
will  be  kept  busy  with  ECD  because  it  will  be  such  a  useful  tool  at  the  tactical  level  and 
the  stipulation  that  FIFO  is  assumed.  Any  single  request  in  the  queue  can  be  fulfilled  if 


5  The  author  has  defined  tactically  acceptable  intelligence  as  requiring  less  than  six  hours  to  produce. 
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that  requirement  is  time  sensitive,  disregarding  the  FIFO  requirement.  At  the  tactical 
level,  infrequently  would  there  be  more  than  three  time  sensitive  requests  which  must  be 
fulfilled  concurrently6.  With  an  average  fulfillment  time  of  105  minutes,  up  to  three  time 
sensitive  requests  could  be  fulfilled  in  order  to  be  considered  intelligence  driving  tactical 
operations.  If  there  are  more  than  three,  another  geographic  location  with  the  ECD 
application  could  be  used  to  augment  the  tactical  scenario  in  question. 

B.  SUMMARY 

Instead  of  being  situated  in  a  single  strategic  operations  center,  ECD  will  be 
integrated  with  another  program  that  is  utilizing  cloud  computing  as  a  way  to 
geographically  separate  the  required  databases  which  ECD  processes.  ECD  will  then 
exist  in  the  application  layer  of  “the  cloud.”  This  will  allow  multiple  users  in  multiple 
theaters  to  use  ECD  regularly  without  the  need  to  send  and  RFI  to  CONUS.  ECD 
relocation  will  lead  to  the  capability  to  regularly  produce  tactical  level  intelligence  in 
multiple  theaters  simultaneously.  The  database  reorganization  will  occur  at  both  the 
JWICS  and  SIPRNet  levels,  permitting  access  to  more  users  at  various  clearance  levels. 


6  “Tactical  level”  in  this  scenario  is  defined  to  be  at  the  USMC  Battalion  level. 
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IV.  COMPARISON  AND  ANALYSIS  OF  ARCHITECTURES 


A.  TIMELINESS  OF  INFORMATION 

1.  Latency  Comparison 

Examining  both  charts  (Figure  26)  of  the  current  and  proposed  processes  side-by- 
side  provides  a  useful  visual  representation  of  the  magnitude  of  latency  eliminated  from 
the  process.  It  is  important  to  note  that  the  proposed  architecture  is  an  entire  order  of 
time  magnitude  (Minutes  versus  Hours)  less  than  the  current  architecture.  This  decrease 
in  latency  allows  for  the  production  of  tactical  intelligence. 

The  combined  graph  in  Figure  26  labeled  “Current  and  Proposed  Comparison” 
illustrates  the  disparity  in  visual  representation  when  both  scenarios  are  overlaid  on  the 
same  axis  in  the  same  unit  of  measurement.  The  frequency  of  occurrence  skews  the 
graph  because  there  is  approximately  one  hundred  percent  chance  an  RFI  will  be  fulfdled 
within  four  hours.  Compressing  the  horizontal  axis  of  the  proposed  process  forces  an 
expansion  of  the  vertical  axis  of  the  same  process.  With  this  expanded  range  in 
frequency,  the  graph  of  the  current  process  appears  to  have  compressed  horizontally. 
This  graph  shows  the  extreme  decrease  in  time  required  to  fulfill  an  RFI.  The  dotted 
green  lines  breakout  the  proposed  process  and  changes  the  units  of  the  horizontal  axis  to 
minutes.  The  solid  orange  lines  breakout  the  current  process  and  do  not  change  the  unit 
of  measure  of  the  horizontal  axis. 
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1  3  9  13  17  21  25  29  33  37  41  45  49  53  57  61  65  69  13 
Time  (Hours) 


1  15  39  43  57  71  Z5  99  1 13  127  141  155  169  133  197 

Time  (Minutes) 


Figure  26.  Current  (Top)  and  Proposed  (Bottom)  Overall  Latencies  and  a 
Comparison  of  Both  Architectures  (Middle). 

When  analyzing  both  architectures  independent  of  queuing  theory,  they  can  each 
handle  the  production  of  one  tactical  intelligence  product.  However,  the  current  process 
can  only  handle  a  couple  of  these  routinely,  and  they  would  be  based  on  the  priority  level 
of  the  requesting  unit.  The  proposed  solution  allows  for  near  continuous  production  of 
tactical  intelligence  products,  if  that  is  what  the  tactical  commander  requires. 
Prioritization  of  desired  intelligence  products  would  be  focused  in  a  smaller  geographic 
region  due  to  the  new  location  of  the  ECD  application,  allowing  more  tactical  operations 
to  implement  ECD. 
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2.  Queuing  Comparison 

Not  only  is  the  overall  timeline  compressed,  but  there  are  other  gains  to  the 
proposed  process  architecture.  Another  important  aspect  of  relocating  ECD  to  a  tactical 
intelligence  cell  focused  on  a  particular  theater  of  operations  is  observed  in  the  sheer 
volume  of  requests  fulfilled  per  unit  time.  This  is  a  function  of: 

•  Having  a  single  SIGINT  analyst  focused  on  the  ECD  application  at  any 
time  during  normal  operations. 

•  Minimal  other  daily  tasks  assigned  to  the  ECD  analyst. 

•  Operating  24  hours  per  day,  7  days  per  week. 


•  Familiarization  of  the  SIGINT  analysts  with  the  EM  environment  in  that 
particular  operational  theater. 


QUEUING  THEORY  METRICS 

CURRENT 

PROPOSED 

Average  number  of  arrivals  per  week. 

20  (Global) 

77  (Theater) 

Average  #  of  people  or  items  served  per  week. 

21  (Global) 

84  (Theater) 

Average  server  utilization  time.  (%) 

95.2 

91.7 

Average  #  of  customers  waiting  in  line  for  service. 

9.1 

5.4 

Average  #  of  customers  or  in  the  system. 

10.05 

6.32 

Average  time  a  customer  spends  waiting  for  service. 

3.2  Days 

11.76  Hours 

Average  time  a  customer  spends  in  the  system. 

3.5  Days 

13.76  Hours 

Probability  that  zero  customers  are  in  the  system.  (%) 

4.8 

8.3 

Table  5.  Comparison  of  Queuing  Theory  Metrics. 


As  declared  at  the  end  of  Chapter  III,  the  proposed  timeliness  is  higher  than  the  queuing 
theory  metrics  due  to  the  FIFO  requirement  for  an  M/G/l  system. 
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3.  Overall  Timeliness  Comparison 


Providing  ECD  to  a  tactical  intelligence  cell  with  a  revised  operating  procedure 
will  increase  the  timeliness  of  the  information  flow  to  the  SIGINT  analyst.  The 
subsequent  table  compares  the  two  architectures  with  respect  to  various  metrics. 


COMPARISON 

CURRENT 

PROPOSED 

Does  the  process  require  an  RFI  to  CONUS  in  order 

to  begin  the  process? 

Yes 

No 

Once  information  is  desired,  when  does  the  process 

begin? 

When  received 

in  CONUS. 

Instantly 

What  is  the  average  time  to  fulfill  an  information 

request  from  the  queue? 

3.5  Days 

13.76  Hours 

How  large  is  an  area  of  interest  per  ECD  location? 

Global 

Operational 

Theater 

In  one  operational  theater,  how  many  requests  can 

be  worked  at  once? 

One  or  Two 

Many 

When  a  high  value  operation  is  planned,  how 

quickly  can  ECD  produce  actionable  intelligence? 

Hours 

<  60  Minutes 

Capable  of  providing  general  situational  awareness 

to  commanders? 

Yes 

Yes 

Capable  of  routinely  assisting  tactical  operations? 

No 

Yes 

Table  6.  Comparison  of  Tactically  Important  Metrics. 


There  are  a  few  assumptions  that  allow  this  table  to  be  accurate.  First,  it  is 
assumed  that  the  analyst  at  the  tactical  level  has  been  trained  and  is  familiar  with  the 
technology.  The  analysts  currently  using  ECD  at  the  strategic  operations  center  are  very 
experienced  analysts  with  decades  of  operational  knowledge  in  the  field.  Since  ECD 
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would  reside  in  multiple  theaters,  the  analyst  in  any  particular  theater  will  be  familiar 
with  the  EM  environment  in  that  particular  area  of  operations. 

B.  INFORMATION  GAINED  BASED  ON  UNCERTAINTY 

1.  Overview 

Danskin,  in  his  theory  of  reconnaissance,  applies  information  theory  to  quantify 
“the  optimum  distribution  of  aerial  reconnaissance  effort  against  land  targets  in  the 
presence  of  decoys”  (Danskin,  1962).  The  information  gained  is  a  function  of  the  amount 
of  reconnaissance  effort  associated  with  a  given  region.  Both  before  and  after  a 
reconnaissance,  the  information  is  quantified  using  the  various  probabilities  of 
uncertainty  coupled  with  that  given  region. 

Danskin’s  theory  was  focusing  on  land  targets  with  probabilities  associated  with 
them.  These  probabilities  for  a  given  region  include: 

p0  =  There  is  no  target. 
px  =  There  is  a  decoy. 
p2  =  There  is  a  target. 

The  summation  of  these  probabilities  is  one.  The  different  probabilities  will  be  redefined 
based  on  signals  per  region.  This  section  will  look  at  Danskin’s  theory  and  apply  it  to  a 
tactical  intelligence  center  with  ECD  as  an  organic  asset. 

2.  Computations 

Transforming  Danskin’s  theory  to  the  realm  of  a  SIGINT  analyst  is  possible,  if 
the  right  variables  are  chosen.7  Before  proceeding  with  this  transformation  to  the  ECD 
application,  a  few  assumptions  and  understandings  need  to  be  stated.  The  SIGINT 
environment  deals  with  many  probabilities  based  on  collection  assets  and  techniques  to 
include  the  probability  of  false  negative  (or  false  detection),  the  probability  of  intercept, 
and  the  probability  of  not  locating  the  target.  These  probabilities  are  resident,  and  will 
continue  to  reside  with  ECD  applied  to  the  signals  data  and  are  not  discussed  or 

7  All  equations  in  this  section,  unless  otherwise  noted,  come  from  Danskin’s  “A  Theory  of 
Reconnaissance:  I.” 
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accounted  for  in  this  analysis.  ECD  does  not  alter  the  data  collected.  All  issues 
associated  with  the  collected  data  do  not  dissipate.  ECD  is  merely  another  way  to 
examination  and  filter  a  signals  database.  It  is  not  the  intent  of  this  analysis  to  challenge 
any  technical  analysis  of  signals  and/or  the  probability  related  to  the  technical  analysis  of 
signals.  The  following  probabilities  are  simply  related  to  the  output  of  ECD  overlaid  on  a 
geographic  region. 

The  computations  begin  with  the  uncertainty  of  a  region  and  probability 
associated  with  this  uncertainty.  There  is  a  signal  probability  associated  with  each 
region,  pj ,  where: 

YJ{pi,...,pn)=\ 

i 

For  ECD  these  can  be  redefined  as: 

p0  =  There  is  no  signal. 

px  =  There  is  a  signal  of  interest  (SOI). 

p2  =  There  is  a  signal  not  of  interest  (SNOI). 

In  this  scenario,  po  +  pi  +  P2  =  1. 

The  uncertainty  for  a  given  region  before  any  reconnaissance  is  defined  as: 

U(p0,pvp2)  =  ~CYJ L Pi  l°g2 (Pi )]  (4-1) 

1=0 

After  the  reconnaissance  is  conducted,  the  probabilities  will  differ  from  those  before  the 
reconnaissance.  A  probability  after  reconnaissance  is  notated  as  p  \ .  The  uncertainty  for 
a  given  region  after  reconnaissance  is  defined  as: 

U(p\,p\,p\)  =  -CYJ[p  \  log2  (p  \ )]  (4.2) 

i= 0 

For  this  thesis  represents  the  probabilities  of  uncertainty  prior  to  the  utilization  of  ECD. 

The  probability  after  the  utilization  of  ECD  is  denoted  as  p  \ .  The  worst  case  scenario  is 

when  all  the  probabilities  are  relatively  equal;  meaning  po  =  pi  =  P2  =  (1/3).  When  these 
three  probabilities  are  equal,  uncertainty  is  maximized  because  no  leverage  can  be  given 
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to  either  decision.  In  this  case,  U(p0,pvp2)  =  0.477*C.  On  the  opposite  end  of  the 

spectrum,  a  case  where  po  =  0.001,  pi  =  0.001,  and  p2  =  0.998  produces  a  low  uncertainty 
of  0.0069*C.  Here,  there  is  a  very  high  certainty  that  p2  is  the  solution. 

The  information  gained  concerning  a  particular  region  is  the  function  I(x)  where  x 
equals  the  amount  of  effort  devoted  to  that  region.  Danskin  defines  the  information 
gained  from  a  reconnaissance  as  the  uncertainty  after  the  reconnaissance  subtracted  from 
the  uncertainty  before  the  reconnaissance,  or: 

I(x)  =  U(p0,pl,p2)-U(p'0,p\,p\) 

I(x)  can  be  rewritten  as: 

I(x)  =  -c£  [p,  log2  (/>,)]■ +  c£  [p log2(p )]  (4.3) 

i= 0  i=0 

This  value  of  I(x)  is  referred  to  as  “the  entropy  of  a  finite  scheme”  (Khinchin  1957) 
equating  the  amount  of  uncertainty  to  information  entropy. 

The  uncertainty  example  above,  where  U(p0,pvp2)=  0.477*C,  can  demonstrate 

how  the  information  will  increase.  Take  the  scenario  with  a  very  low  uncertainty  as  the 
probabilities  associated  with  a  region  after  the  reconnaissance  (or  Post-ECD).  This 
would  mean  p’o  =  0.001,  p’i  =  0.001,  and  p’2  =  0.998  yielding  U(p'0,p\,p'2)  = 

0.0069*C.  In  this  case  I(x)  =  U(p0,pvp2)-U(p'0,p\,p'2)=  0.477*C  -  0.0069*C  = 

0.47*C.  The  scenario  takes  a  region  of  high  uncertainty,  filters  it,  and  produces  a  region 
of  very  low  uncertainty  that  yields  a  high  uncertainty  differential  with  an  informational 
output  value  multiplied  by  some  constant. 

With  respect  to  ECD,  pt  represents  the  probabilities  of  uncertainty  prior  to  the 

utilization  of  ECD.  The  probability  after  the  utilization  of  ECD  is  denoted  as  p  \ .  This 

equates  to  the  amount  of  information  gained  depends  the  amount  of  uncertainty  in  the 
region  eliminated  by  ECD.  SIGINT  analysts  want  to  decrease  uncertainty;  however,  they 
want  to  decrease  it  in  a  certain  way.  Concerning  the  probability  of  signals,  the  analysts 
want  to  maximize  the  combination  of  po  and  pi  and  minimize  P2.  The  situation  above, 
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where  p2  was  maximized,  is  useless  to  a  SIGINT  analyst  because  that  means  that  most  of 
the  signals  on  the  map  are  SNOIs.  If  most  signals  are  not  of  interest,  the  analyst  must 
still  allocate  man  hours  searching  for  SOIs. 

3.  Selected  Scenarios 

The  following  two  scenarios  will  quantify  the  information  gained  using  ECD. 
The  first  scenario  is  dedicated  to  a  region  that  is  densely  populated.  A  sparsely  populated 
region  is  the  focus  of  the  second  scenario.  Appendix  D  shows  the  Microsoft  Excel 
spreadsheet  with  the  calculations  and  formulas  for  both  of  the  following  scenarios. 

a.  Densely  Populated  Region 

Consider  a  highly  populated  geographical  area,  most  likely  a  major  city. 
Now  consider  the  amount  of  signals  jammed  into  this  relatively  small  geographical 
location.  A  snapshot  in  time  of  the  EM  environment  in  a  major  populated  area  is 
obviously  difficult  for  a  SIGINT  analyst  to  tackle  due  to  the  vast  number  and  types  of 
signals  in  a  small  region.  Finding  an  SOI  is  extremely  difficult. 

In  this  setting,  po  would  equal  zero.  Since  the  logarithm  function  of  zero 
is  undefined,  this  terms  falls  out  of  the  summation.  Now  it  is  paramount  to  consider  the 
probabilities  of  SOIs  versus  SNOIs.  It  is  assumed  that  a  major  city  will  have  a  very  small 
number  of  SOIs  as  compared  to  SNOIs  simply  because  most  of  the  population  is  not 
communicating  a  signal  considered  interesting  to  a  SIGINT  analyst.  This  assumption 
allows  pi  to  be  extremely  low  compared  to  p2.  The  probability  of  an  SOI  is  set  at  less 
than  one  percent,  or  pi  =  0.005  generating  p2=  0.995  since  the  po  +  Pi  +  P2  =  1. 

After  running  ECD  on  this  geographic  area,  the  result  is  a  less  cluttered 
snapshot  of  the  EM  environment.  Since  ECD  eliminates  the  redundant  signals,  the  value 
of  p\  will  increase.  This  increase  will  yield  an  increase  in  p j also  because  the 

redundant  signals  tend  to  be  SNOIs  vice  SOIs.  Taking  the  following  values  of  p  \ : 

p'0  =  0.40 

p\  =0.01 

p'2=  0.59 
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Inserting  these  values8  into  equation  (4.3)  produces  I(x)  =  (-1.0)*C. 

These  results  are  counterintuitive  due  to  the  negative  value  associated  with 
the  calculations.  Given  that,  the  overall  uncertainty  is  increasing,  then  the  information 
gained  is  decreasing.  This  is  because  ECD  decreased  the  probability  of  a  signal  being  of 
non-interest  vice  one  of  interest.  For  the  SIGINT  analyst,  an  increase  in  po  +  pi  and  a 
decrease  in  p2  is  the  desired  situation.  Within  a  specific  region,  the  amount  of  area  where 
there  are  no  signals  (po)  means  there  is  less  area  to  evaluate  and  a  greater  chance  that  a 
known  signal  is  one  of  interest. 

In  this  scenario,  forty  percent  of  the  map  does  not  contain  a  known  signal. 
This  eliminated  SNOIs  and  increased  the  probability  of  an  SOI  to  two  percent,  with  the 
remaining  fifty-eight  percent  being  SNOIs.  The  probability  of  desired  outcomes  before 
ECD  (po  +  pi)  and  after  ECD  (p’o  +  p’i)  went  from  less  than  one  percent  to 
approximately  forty-two  percent.  Overall,  the  information  gained  decreased  because  the 
uncertainty  in  the  environment  increased,  but  the  uncertainty  of  an  SNOI  also  decreased, 
which  is  a  desired  objective  of  ECD. 

b.  Sparsely  Populated  Region 

Now  consider  a  sparsely  populated  geographical  area,  a  small  village  in 
the  middle  of  a  barren  region.  Now  consider  the  minuscule  amount  of  signals  in  this 
region  (compared  to  a  major  city).  A  snapshot  in  time  of  the  EM  environment  in  this 
scenario  is  not  as  difficult  for  a  SIGINT  analyst  to  tackle  as  in  the  previous  example. 
However,  a  SIGINT  analyst  must  consider  all  locations  where  an  SOI  could  appear.  The 
faster  an  analyst  can  filter  through  a  region  of  this  nature,  than  the  faster  that  analyst  can 
undertake  areas  of  dense  population. 

In  this  setting,  there  is  a  seventy  percent  chance  that  there  is  not  a  signal  in 
a  particular  area,  po  =  0.7.  Now  consider  the  probabilities  of  SOIs  versus  SNOIs.  It  is 
assumed  that  a  thinly  populated  area  of  interest  will  have  few  SOIs  as  compared  to 

8  All  values  of  p,  and  p’,  in  both  scenarios  are  arbitrary  and  based  purely  on  the  author’s  experience 
with  a  few  ECD  final  products.  The  values  will  vary  based  on  geographic  region  and  situation;  however, 
the  relationship  between  the  probabilities  will  be  similar.  This  is  important  because  quantifying  the 
information  gained  depends  heavily  on  both  geographic  region  and  situation. 
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SNOIs;  but  not  as  few  as  a  major  city.  The  probability  of  an  SOI  is  set  at  five  percent,  or 
pi  =  0.05  generating  p2=  0.25  since  the  po  +  Pi  +  P2  =  1. 

After  running  ECD  on  this  geographic  area,  the  result  is  an  even  less 
cluttered  snapshot  of  the  EM  environment.  Since  ECD  eliminates  the  redundant  signals, 
the  value  of  p\  will  again  increase.  As  before,  this  increase  will  yield  a  slight  increase 

in  p  j  also  because  the  redundant  signals  tend  to  be  SNOIs  vice  SOIs.  Taking  the 
following  values  of  p  \ : 

p\  =  0.85 
p\  =0.055 
p\  =0.095 

Inserting  these  values  into  equation  (4.3)  produces  I(x)  =  (0.32)*C. 

These  results  are  more  intuitive  than  the  previous  example  due  to  the 
positive  value  of  information  gained.  Given  that,  the  overall  uncertainty  is  decreasing, 
then  the  information  gained  is  increasing-,  opposite  of  the  previous  scenario.  Just  like 
before,  the  amount  of  area  where  there  are  no  signals  (po)  means  there  is  less  area  to 
evaluate  and  a  greater  chance  that  a  known  signal  is  one  of  interest  in  a  specific  region. 

In  this  scenario,  eighty-five  percent  of  that  region  does  not  contain  a 
known  signal.  This  eliminated  SNOIs  and  increased  the  probability  of  an  SOI  by  only 
one-half  of  a  percent.  The  probability  of  desired  outcomes  before  ECD  (po  +  pi)  and 
after  ECD  (p’0  +  p’i)  went  from  seventy- five  percent  to  just  over  ninety  percent.  Overall, 
the  information  gained  increased  because  the  uncertainty  in  the  environment  decreased, 
and  the  uncertainty  of  an  SNOI  also  decreased,  which  once  more  is  a  desired  objective  of 
the  ECD  application. 

4.  Summary 

Applying  ECD  to  a  given  region  can  be  compared  to  conducting  an  aerial 

reconnaissance  over  land  targets.  Quantifying  the  amount  of  information  gained  based 

on  the  level  of  uncertainty  shows  an  increase  in  the  summation  of  the  probability  of  no 

signal  and  the  probability  of  an  SOI.  A  negative  or  positive  value,  based  on  scenario, 
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will  determine  the  level  of  increase  of  information.  This  quantified  value  will  change 
based  on  geographic  location,  situation,  and  mission  to  be  accomplished.  Of  importance 
is  the  relative  decrease  in  the  probability  of  an  SNOI. 

C.  TIME  GAINED  BASED  ON  UNCERTAINTY 

1.  Overview 

Determining  the  level  of  uncertainty  is  a  necessary  step  to  understanding  the  EM 
environment  within  a  given  region.  A  SIGINT  analyst  requires  a  certain  amount  of  time 
to  analyze  a  given  geographic  region  in  order  to  fully  understand  the  EM  environment. 
Understanding  this  environment  well  will  aid  commanders  in  making  decisions  to 
accomplish  their  mission.  This  analysis  consumes  a  certain  amount  of  the  analyst’s  time. 
As  seen  in  the  previous  section,  a  reduction  in  uncertainty  leads  to  an  increase  in  the 
amount  of  information  provided.  This  section  calculates  how  this  same  reduction  in 
uncertainty  will  condense  the  amount  of  time  necessary  to  locate  an  SOI. 

2.  Scenario 

As  a  SIGINT  analyst  begins  analyzing  a  new  region,  the  level  of  uncertainty  is 
high.  Over  time,  that  level  of  uncertainty  decreases  to  an  acceptable  level.  Determining 
what  defines  an  acceptable  level  is  situational  dependent.  Assumed  in  this  analysis  is  a 
linear  relationship  between  the  level  of  uncertainty  and  time  spent  on  analysis.  The  slope 
of  this  line  is  dependent  on  various  characteristics  to  include  the  analyst’s  expertise, 
operational  environment,  and  mission. 

The  following  chart  represents  a  scenario  where  there  is  initially  a  very  high  level 
of  uncertainty  in  the  EM  environment.  Over  time,  the  analyst  filters  out  the  unnecessary 
information  to  point  where  he/she  is  comfortable  with  the  operating  environment.  This 
level  of  uncertainty  is  assumed  to  be  0.1,  or  ten  percent  and  is  indicated  by  a  green 
dashed  line  in  the  chart. 
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Figure  27.  Environmental  Uncertainty  Prior  to  ECD. 


Running  ECD  will  alleviate  a  percentage  of  (redundant)  signals  in  the  operating 
environment.  Eliminating  these  signals  leads  to  an  overall  lower  initial  level  of 
uncertainty  in  that  environment.  It  is  important  to  note  that  there  are  no  claims  being 
made  that  ECD  will  speed  up  a  SIGINT  analyst’s  ability  to  analyze  a  given  environment. 
This  is  visually  depicted  in  the  equal  slopes  of  the  lines  on  the  charts.  What  is  simply 
being  stated  is  that  the  initial  conditions  of  that  operating  environment  are  altered  due  to 
ECD  by  decreasing  the  level  of  uncertainty  in  that  region,  as  shown  in  Figure  28. 
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Overlaying  the  two  charts  shows  that  the  slopes  remain  constant.  The  only 
difference  is  the  starting  baseline  for  the  analysis  of  that  environment.  Like  the  previous 
two  charts,  the  green  dashed  line  represents  the  minimum  acceptable  amount  of 
uncertainty  for  a  given  region. 


Environment  Comparison 


- Environment  Before  ECD 

- En  vironment  After  ECD 


Figure  29.  Environment  Comparison  Before  and  After  ECD. 


3.  Summary 

One  can  see  that  with  the  application  of  ECD,  less  time  is  required  to  analyze  a 
given  environment.  The  At,  or  change  in  analysis  time,  is  dependent  on  the  decrease  in 
the  level  of  uncertainty  and  slope  of  the  analyst’s  uncertain  line.  An  important 
assumption  to  validate  the  previous  statement  is  the  linear  relationship  between 
uncertainty  and  analysis  time.  Decreasing  this  time  interval  is  paramount  to  the  quicker 
completion  of  a  commander’s  OODA  loop. 


D.  VISUAL  REPRESENTATION  OF  INFORMATION  PROVIDED  TO  THE 
TACTICAL  COMMANDER 

This  section  is  located  in  a  classified  appendix. 


59 


THIS  PAGE  INTENTIONALLY  LEFT  BLANK 


60 


V.  CONCLUSIONS  AND  RECOMMENDED  FUTURE  WORK 


A.  CONCLUSIONS 

SIGINT  analysts  are  constantly  overwhelmed  by  the  amount  of  data  they  ingest 
and  ECD  was  fashioned  in  order  to  alleviate  a  portion  of  the  “background  noise,”  or 
signals  of  non-interest.  ECD  has  been  tested  and  its  operational  capability  verified  and 
validated  by  senior  analysts.  With  the  current  organizational  structure  within  which  ECD 
resides,  its  utility  to  the  tactical  user  is  limited.  This  limitation  affects  both  the  timeliness 
of  intelligence  production  and  volume  of  users  it  can  accommodate.  An  analytical  model 
was  devised  to  determine  the  sources  of  latency  in  response  to  a  request  for  information 
(RFI).  Various  obstacles  are  highlighted  and  a  revised  operating  procedure  was  modeled. 

This  thesis  analyzes  four  aspects  of  an  organization  (task,  technology,  structure, 
and  actors)  and  proposes  a  change  in  ECD  implementation  to  affect  the  production  of 
tactical  intelligence.  The  intent  of  the  revision,  along  with  providing  ECD  to  a  tactical 
intelligence  cell,  is  to  allow  the  tactical  commander  to  make  more  effective  decisions 
with  respect  to  the  employment  and  deployment  of  forces,  types  of  forces  (kinetic  versus 
non-kinetic)  to  employ,  and  maximizing  the  efficiency  of  organic  intelligence  collection 
assets.  The  organizational  revision,  coupled  with  required  analyst  training,  allows 
information  to  be  pushed  to  a  tactical  intelligence  cell  and  commander  within  a  window 
of  six  hours  from  collection  of  the  signal.  This  window  allows  for  the  production  of 
actionable  intelligence,  increases  the  efficiency  of  SIGINT  analysts,  and  potentially 
drives  tactical  operations. 

In  order  to  effectively  enhance  a  tactical  commander’s  decision-making  process, 
the  OODA  loop  timeline  must  be  condensed  while  provide  the  same,  if  not  more, 
information.  ECD  is  proven  to  increase  the  amount  of  information  gained  by  decreasing 
the  uncertainty  of  information  within  a  given  region.  This  decrease  in  uncertainty,  with 
all  other  parameters  being  equal,  decreases  the  amount  of  time  required  to  understand  the 
EM  environment  in  a  given  scenario.  As  ECD  positively  affects  uncertainty  and 
timeliness,  the  tactical  commander’s  first  two  steps  (observe  and  orient)  in  the  OODA 
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loop  condense,  allowing  decisions  to  be  made  faster  and  actions  to  occur  faster. 
Condensing  the  OODA  loop  enough  will  force  an  adversary  to  be  reactive  vice  proactive 
to  coalition  operations. 

B.  TACTICAL  APPLICATION 

ECD  has  passed  all  initial  experimentation,  verification,  and  validation9  and  is 
currently  operational  on  a  small  scale  at  a  strategic  operations  center.  The  best  way  to 
test  the  effectiveness  at  the  tactical  level  is  to  integrate  ECD  with  a  unit  who  has  previous 
operational  experience  in  support  of  OIF  and/or  OEF  and  will  deploy  in  support  of  OIF 
and/or  OEF  in  the  near  future.  Personnel  who  have  deployed  both  with  and  without  ECD 
technology  will  measure  the  tactical  usefulness  and  effectiveness. 

The  author  has  selected  1st  Radio  Battalion  (IstRadBn)  located  at  Camp 
Pendleton,  California  as  the  tactical  unit  with  which  to  evaluate  and  assess  the  usefulness 
of  ECD  at  the  battalion  level.  This  selection  was  based  on: 

1.  The  author’s  familiarity  with  the  integration  of  a  Radio  Battalion  in 
Marine  Air  Ground  Task  Force  (MAGTF)  operations. 

2.  The  operational  tempo  of  deployments  in  support  of  OIF  by  IstRadBn. 

3.  The  operational  experience  of  IstRadBn  leadership  and  SIGINT  analysts 
alike  in  support  of  OIF. 

4.  The  geographic  location  of  1  stRadBn  with  respect  to  the  NPS. 10 

Personnel  interviews  were  conducted  with  IstRadBn  in  order  to  discuss  with 
SIGINT  experts  the  utility  of  this  technology  and  its  effects  on  battalion  operations.  The 
effects  were  viewed  as  positive.  Ideally,  ECD  will  be  implemented  in  an  upcoming 
deployment  in  support  of  OIF  or  OEF. 


9  Details  of  all  experimentation,  verification,  and  validation  are  classified. 

it  is  not  the  intent  of  the  author  to  conclude  that  any  bias  has  been  given  to  IstRadBn  over  the  other 
Radio  Battalions  based  on  performance.  For  the  purpose  of  thesis  research,  funding  was  allotted  for  travel 
within  California,  making  IstRadBn  the  optimal  tactical  unit  to  select. 
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IstRadBn  and  the  author  agreed  to  use  a  past  operational  significant  event  as  a 
template  for  trend  analysis.  Analyzing  the  situation  with  ECD,  including  the  events  that 
led  up  to  the  significant  event  and  possible  tippers  of  its  occurrence,  will  demonstrate  a 
noteworthy  capability  ECD  would  provide  to  IstRadBn.  The  true  value  of  ECD  will  only 
be  realized  once  provided  to  a  tactical  unit  conducting  real-world  operations  with  a 
defined  and  distinct  situation  and  mission. 

C.  RECOMMENDED  FUTURE  WORK 

Several  areas  of  future  research  and  work  have  been  identified  throughout  the 
creation  of  this  thesis.  They  are: 

•  Derive  an  alternate  evaluation  method,  involving  conditional  entropy, 
which  is  “entropy  of  a  random  variable,  given  another  random  variable” 
(Cover,  1991). 

•  Identify  quantifiable  evidence  of  proper  decision-making  based  on  ECD. 

•  Quantify  the  utility  of  ECD  with  respect  to  maximizing  organic 
intelligence  collection  assets  at  the  tactical  level. 

•  Analyze  the  utility  and  information  gained  (cost-benefit  analysis)  of 
providing  ECD  on  both  JWICS  and  SIPRNet. 

•  Continue  end-user  collaboration  with  1st  Radio  Battalion,  USMC  with  the 
intent  of: 

o  Evaluating  real-world  operational  tests  (Pre-  and  Post-ECD). 

o  Reassessing  best/most-practical  implementation  practices. 

o  Continuing  revision  of  operating  procedures  from  lessons  learned 
via  operational  testing. 

o  Outlining  and  implementing  an  ECD  application  training  plan. 

•  Analyze  the  effect  of  ECD  at  the  MAGTF  Commander  level  with 
implementation  at  a  Radio  Battalion. 
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APPENDIX  A.  CURRENT  PROCESS  DIAGRAM 


The  following  is  a  typical  path  in  the  RFI  submittal  process.  The  process  begins 
with  the  observation  of  an  intelligence  gap. 


RFI  Submission 


•  Intelligence  gap  observed. 

•  Requirement  identified. 

•  RFI  submitted. 


Once  the  RFI  reaches  the  U.S.  (CONUS),  it  is  placed  in  a  queue  and  resides  there  until  an 
analyst  begins  to  process  the  RFI.  The  next  diagram  is  characteristic  of  the  information 
flow  between  analysts. 
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A  simplistic  visualization  of  this  process  is  as  follows. 


o 


Anafcwl 


Once  the  finalized  report  is  properly  formatted,  the  RFI  is  sent  back  to  its  originator. 


RFI  Fulfillment 


•  Dual  motion  process. 

Requires  a  “push”  from  CONUS. 
Requires  a  knowledgeable  “pull” 


The  rest  of  the  process  resides  in  the  theater  of  operations.  At  this  time  in  the  process,  it 
is  necessary  to  consider  what  rework  (if  any)  is  required. 
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RFI  ORIGINATOR 

What  rework  is  necessary? 

RFI  resubmit  and  refinement. 
New  RFI  submission  based 
on  findings  from  previous 
RFI. 

No  knowledgeable 
representative  in  theater. 


RFI  REWORK/RESUBMIT  REQUIRES  CYCLE  TO  BEGIN  ANEW  THROUGH  CONUS 


In  Theater  Process 
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APPENDIX  B.  CURRENT  PROCESS  HOURLY  PROBABILITY 


RFI  Submittal 
Reference 
(7am  -  5pm) 

Actual 

Time 

Latency 

(Hrs) 

work  day 

0  -  1 

5am  (Mon) 

1  -  2 

4am 

2  -  3 

3am 

3  -  4 

2am 

4  -  5 

lam 

5  -  6 

midnight 

6-  7 

11pm 

7  -  8 

10pm 

8  -  9 

9pm 

9  -  10 

8pm 

10  -  11 

7pm 

11  -  12 

6pm 

12  -  13 

5pm 

13  -  14 

14  -  15 

3pm 

15  -  16 

2pm 

16  -  17 

1pm 

17  -  18 

noon 

18  -  19 

11am 

19  -  20 

10am 

20  -  21 

9am 

21  -  22 

8am 

22  -  23 

7am 

23  -  24 

6am 

24  -  25 

5am 

25  -  26 

4am 

26  -  27 

3am 

27  -  28 

2am 

28  -  29 

lam 

29  -  30 

30  -  31 

11pm  (Sat) 

31  -  32 

10pm 

32  -  33 

9pm 

33  -  34 

8pm 

34  -  35 

7pm 

35  -  36 

6pm 

36  -  37 

5pm 

37  -  38 

4pm 

38  -  39 

Frequency 
of  Occurrence 
(Hrs  per 
week) 

55 

5 

5 

5 

5 

5 

5 

5 

5 

5 

5 

5 

5 

5 


Probability 

of 

Occurrence: 

P(X) 

Expected 

Value: 

E(X) 

Population 

Variance: 

V(X) 

NORMALIZED 

0.327380952 

0.327381 

58.9831465 

0.017049084 

0.029761905 

0.0595238 

4.59290071 

0.017797419 

0.029761905 

0.0892857 

3.88322101 

0.018516944 

0.029761905 

0.1190476 

3.23306511 

0.019201623 

0.029761905 

0.1488095 

2.64243303 

0.019845538 

0.029761905 

0.1785714 

2.11132475 

0.020442979 

0.029761905 

0.2083333 

1.63974028 

0.020988519 

0.029761905 

0.2380952 

1.22767963 

0.021477106 

0.029761905 

0.2678571 

0.87514278 

0.021904132 

0.029761905 

0.297619 

0.58212974 

0.022265511 

0.029761905 

0.327381 

0.34864051 

0.022557742 

0.029761905 

0.3571429 

0.17467509 

0.022777964 

0.029761905 

0.3869048 

0.06023348 

0.022924007 

0.029761905 

0.4166667 

0.00531568 

0.022994421 

0.005952381 

0.0892857 

0.00198434 

0.022988507 

0.005952381 

0.0952381 

0.0148103 

0.022906324 

0.005952381 

0.1011905 

0.03954103 

0.022748688 

0.005952381 

0.1071429 

0.07617651 

0.022517161 

0.005952381 

0.1130952 

0.12471676 

0.022214025 

0.005952381 

0.1190476 

0.18516178 

0.021842242 

0.005952381 

0.125 

0.25751155 

0.021405407 

0.005952381 

0.1309524 

0.34176608 

0.020907693 

0.005952381 

0.1369048 

0.43792538 

0.02035378 

0.005952381 

0.1428571 

0.54598944 

0.019748784 

0.005952381 

0.1488095 

0.66595826 

0.019098179 

0.005952381 

0.1547619 

0.79783184 

0.018407717 

0.005952381 

0.1607143 

0.94161019 

0.017683336 

0.005952381 

0.1666667 

1.09729329 

0.016931086 

0.005952381 

0.172619 

1.26488116 

0.016157039 

0.005952381 

0.1785714 

I.44437379 

0.015367211 

0.005952381 

0.1845238 

1.63577119 

0.014567488 

0.005952381 

0.1904762 

1.83907334 

0.013763555 

0.005952381 

0.1964286 

2.05428026 

0.012960833 

0.005952381 

0.202381 

2.28139193 

0.012164423 

0.005952381 

0.2083333 

2.52040837 

0.011379062 

0.005952381 

0.2142857 

2.77132958 

0.010609081 

0.005952381 

0.2202381 

3.03415554 

0.009858376 

0.005952381 

0.2261905 

3.30888627 

0.00913039 

0.005952381 

0.2321429 

3.59552175 

0.008428099 

3pm 

39  -  40 

1 

0.005952381 

0.2380952 

3.894062 

0.007754008 

2pm 

40  -  41 

1 

0.005952381 

0.2440476 

4.20450701 

0.007110157 

1pm - 

41  -  42 

1 

0.005952381 

0.25 

4.52685679 

0.006498131 

noon 

42  -  43 

1 

0.005952381 

0.2559524 

4.86111132 

0.005919078 

11am 

43  -  44 

1 

0.005952381 

0.2619048 

5.20727062 

0.005373732 

10am 

44  -  45 

1 

0.005952381 

0.2678571 

5.56533468 

0.00486244 

9am 

45  -  46 

1 

0.005952381 

0.2738095 

5.9353035 

0.004385195 

8am 

46  -  47 

1 

0.005952381 

0.2797619 

6.31717708 

0.003941666 

7am 

47  -  48 

1 

0.005952381 

0.2857143 

6.71095543 

0.003531239 

6am 

48  -  49 

1 

0.005952381 

0.2916667 

7.11663853 

0.003153049 

5am 

49  -  50 

1 

0.005952381 

0.297619 

7.5342264 

0.00280602 

4am 

50  -  51 

1 

0.005952381 

0.3035714 

7.96371903 

0.002488897 

3am 

51  -  52 

1 

0.005952381 

0.3095238 

8.40511642 

0.002200288 

2am 

52  -  53 

1 

0.005952381 

0.3154762 

8.85841858 

0.001938691 

lam 

53  -  54 

1 

0.005952381 

0.3214286 

9.32362549 

0.001702526 

midnight  (Fri/Sat) 

54  -  55 

1 

0.005952381 

0.327381 

9.80073717 

0.001490169 

11pm  (Fri) 

55  -  56 

1 

0.005952381 

0.3333333 

10.2897536 

0.00129997 

10pm 

56  -  57 

1 

0.005952381 

0.3392857 

10.7906748 

0.001130284 

9pm 

57  -  58 

1 

0.005952381 

0.3452381 

11.3035008 

0.000979486 

8pm 

58  -  59 

1 

0.005952381 

0.3511905 

11.8282315 

0.00084599 

7pm 

59  -  60 

1 

0.005952381 

0.3571429 

12.364867 

0.000728263 

6pm 

60  -  61 

1 

0.005952381 

0.3630952 

12.9134072 

0.000624839 

5pm 

61  -  62 

1 

0.005952381 

0.3690476 

13.4738523 

0.000534323 

168 

14.42262 

300.82735 

Standard  Deviation  = 

17.344375 

hrs 

= 

17  hrs  21 

mins 
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APPENDIX  C.  SENIOR  EXECUTIVE  PRESENTATION 


Captain  Derek  Filipe,  USMC 

*  B.S,  Mechanical  Engineering,  The 
George  Washington  University,  2003 

*  Pursuing: 

-  M.S.  in  Systems  Technology 

-  M.S.  in  Space  Systems  Operations 

*  OPERATION:  ENDURING  FREEDOM 

-  Intelligence  Officer,  HMH-462 

-  Sep  20(14  -  Mar  2005 

*  OPERATION:  IRAQI  FREEDOM 

-  Intelligence  Advisor,  Iraqi  Border  Patrol 

-  Apr  2006 -Apr  2007 


FOCUS  AREAS 

*  Organizational  Analysis 

*  Command  &  Control  Analysis 

*  Tactical  Dissemination  Analysis 

METHODS 

*  Quantitative  Analysis 

*  End-User  Collaboration 

*  Personnel  Interviews 

*  Operational  Testing 


ENDSTATE:  OPTIMIZATION  OF  INFORMATION  FLOW  TO 

TACTICAL  LEVEL 


UNCLAS5//toU0 


Energy  Change  Detection 

If  Energy  Change  Detection  (ECD)  is  provided  to  a  tactical 
intelligence  cell  with  a  revised  operating  procedure,  then 
the  potential  for  more  effective  decision-making  by  the 
tactical  commander  exists,  allowing  said  commander  to 
make  more  informed  decisions  on: 

*  Employment  and  deployment  of  forces. 

*  Which  type  (kinetic  versus  non-kinetic  effects)  of 
forces  to  employ. 

*  How  to  maximize  the  utilization  of  organic 
intelligence  collection  assets. 


UNCLASS//FOUO 
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Approach 


•  Work  with  the  analysts  to  be  able  to  effectively 
model  the  current  employment  of  ECD, 

•  identify  pitfalls  and  sources  of  latency  in  the 
current  model. 

•  Propose  a  new  operating  procedure  for  ECD. 

-  Implement  and  test. 


UNCLASS//FOUO 


^ip7  Current  ECD  Process 


•  Process  initiated  once  RFI  submitted. 

-  Observation  of  an  intelligence  gap. 

-  Requirement  identified. 

-  "Push-and-Pull"  system. 

•  Large  disparity  in  time  interval  once  RFI  submitted. 

-  Dependent  on  CONUS  workday. 

•  End  User  not  familiar  with  process. 

-  Does  not  know  what  to  ask  for. 

-  Does  not  fully  understand  the  capabilities. 

-  Cannot  submit  RFI  until  the  requirement  exists. 
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Current  Process 


■  P  hase  1:  RFi  $  u  bm  itt  a  I 

*  l  ntel  I  igence  gap  observed. 

-  Requirement  identified. 

-  rfi  submitted. 


[NFS 


Queuing  Calculations 


Characteristics  of  (M/G/l)  System 

Current  Process 

Average  number  of  RFis  received  per  week  (Based  on 
Historical  Data). 

20 

Maximum  service  rate  (Number  of  RFis  per  week). 

21 

Percent  utilization. 

95 

Number  of  RFis  in  the  queue. 

9.1 

Number  of  RFis  in  the  system. 

10 

Average  time  spent  waiting  in  the  queue  per  RFI  (days). 

Average  time  spent  in  the  system  per  RFi  (days). 

Percentage  that  there  are  no  RFis  in  the  system. 

5 
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Current  Problem  Areas 

•  Potential  sources  of  latency. 

1.  Information  versus  intelligence. 

2.  "Pushing"  vs.  "Pulling"  information. 

3.  Bottleneck. 

4.  Human-in-the-loop. 

5.  Clearance  and  access. 


UNCLASS//FOUO 


Proposed  Solution 


♦  ECDonSIPR. 

-  SI/TK  versus  functionality. 

*  KMLs  "pushed"  to  ail  users. 

-  Geo-Filtered  reports. 

-  4  hour  time  intervals,  tactically  acceptable. 

-  Historic  reports  useful  for  trend  analysis. 

*  Eliminates  the  RFI  submittal  process. 

-  Instant  access  upon  requirement  realization. 

•  Removal  of  the  Human-in-the-loop. 

-  Human  needed  for  analysis,  not  information  push. 
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^sp  Preliminary  Conclusions 


•  Time  to  fully  implement  this  technology. 

-  Ready  for  Full  Operational  Capability. 

-  Clear  and  present  utility  at  the  tactical  level. 

-  High  potential  to  drive  operations. 

•  Reside  on  either  SI/TK  system  and/or  SIPRNET. 

-  Pros  and  Cons  analysis  of  residing  on  both. 

-  Database  storage  concerns  require  analysis. 

•  End  User  familiarization  necessary. 


UNCLASS//FOUO 


^j|p  Way  Forward 


*  Technology  implementation. 

-  Collaboration  with  Mr.  John  Abe. 

-  Database  familiarization. 

*  End  User  collaboration. 

-  1st  Radio  Battalion,  USMC. 

-  Camp  Pendleton,  CA, 

-  Potential  for  real-world  operational  testing. 

-  Reassessment  of  best/most-practical  implementation. 

—  After  Action  Reports  /  Lessons  Learned. 

-  Revision  of  operating  procedures. 
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Implications 


Intelligence  Cell 


( - r - \ 

Energy 

Change 

^  Detection  d 


More  Effective  Decision-Making 


1*  Effective  employment  and  deployment  of  forces. 

2,  Correct  determination  of  types  of  forces  to  employ. 

3.  Better  focused  organic  intelligence  collection  assets. 


*  Provides  a  tool  to  the  tactical  commander  useful  in  asymmetric  conflict, 

*  Adversary  does  not  know  we  have  this  capability, 

*  Cannot  defend  against  it, 

-  Cannot  use  Camouflage,  Denial,  or  Deception  to  defeat  it, 

*  Compels  the  adversary  to  be  REACTIVE  vice  PROACTIVE, 

U  ISlC  LASS/ /FOU0 


Captain  Derek  A.  Filipe,  USMC 

Student,  Joint  C4I  (365)  &  Space 
Systems  Operations  (366)  Curriculums 
Naval  Postgraduate  School 
NIPR:  dafilipe@nps.edu 
SIPR:  filipeda@nps.navy.smil.mil 
JWICS:  gdfilda@nps.pacom.ic.gov 
Telephone:  202.487.5626 
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APPENDIX  D.  SCENARIO  CALCULATIONS  AND  FORMULAS 


I(x)  =  Information  gained  concerning  a  particular  region 

x=  Amount  of  effort  devoted  to  that  region 

(x  is  constant  with  respect  to  ECD) 

There  is  uncertainty  associated  with  each  signal. 

P0=  There  is  no  signal 

Pl=  Signal  of  Interest  (SOI) 

P2=  Signal  Not  of  Interest  (SNOI) 

P0+P1+P2  =  1 

Uncertainty  for  1  region:  U(P0,P1,P2)=  -c[SUM(Pi  log  Pi)] 

Uncertainty  as  a  result  of  ECD:  U(P'0,  P'1,  P'2)=  -c[SUM(P'i  log  P'i)] 
The  information  produced  by  ECD: 


I(x)  =  U(P0,P1,P2)  -  U(P'0,  P'I,  P'2) 


SCENARIO  1:  DENSELY  POPULATED  REGION 

O 

II 

o 

CL 

d 

II 

o 

Q_ 

Pl=  0.005 

P'l=0.01 

P2=  0.995 

P'2=  0.59 

U(P0,P1,P2)  = 

0.045414692c 

U(P'0,  P'1,  P'2)  = 

1.044325553c 

I(x)  = 

-0.998911c 

SCENARIO  2:  SPARSELY  POPULATED  REGION 

d 

II 

o 

CL 

P'0=  0.85 

Pl=  0.05 

P'l=  0.055 

P2=  0.25 

P'2=  0.095 

U(P0,P1,P2)  = 

1.076297626c 

U(P'0,  P'1,  P'2)  = 

0.752052041c 

I(x)  = 

0.3242456c 
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